How to block connections without ClientHello packet?

RouterOS Beginner Basics
1

Hi,

I need to block all tcp port 443 connections which don’t contains clienthello packet after tcp syn,ack.
I can’t realize how catch queue of packets in every tcp connection. It looks like impossible to do this on RoutesOS.

Can you help?

Thank you

2

i think maybe this way:

allow start the connection until certain threshold of traffic like 60k connection-bytes , in this interval inspect for rigth hello using content

if connection match content mark that connection to allow it freely

drop any connection not marked beyond 60k connection-bytes