Hello there @gtownsend, thanks for filing the issue. Nice catch.

My apologies, the bug is that unfortunately I mismatched and used:

• []byte("\x4F\x67\x67\x53\x00")
  instead of
• []byte("\xFF\xFF\xFF\xFF\xFF")
  as the mask
  

  go/src/net/http/sniff.go

  Lines 109 to 113 in b9daf0a

  	&maskedSig{
  	mask: []byte("OggS\x00"),
  	pat: []byte("\x4F\x67\x67\x53\x00"),
  	ct: "application/ogg",
  	},

The algorithm and reference that we use is at:

I'll make a CL and a test for it, although Brad is on vacation for a week, but if anyone can help me review and merge it that'd be nice.

Anyways, the catch here is that the bug for "application/ogg" gives a false positive if the byte pattern BITWISE AND'd with 4F 67 67 53 00 in hex matches itself 4F 67 67 53 00 for example:

• oooS
• owow

CL https://golang.org/cl/44336 mentions this issue.

/cc @bradfitz @rsc can this go in for Go1.9?