return fc.GetTransportProtocol() == ""
	}, func(fc *listener.FilterChainMatch) bool {
		if !hasTLSInspector {
			// Without tls inspector, transport protocol will always be raw buffer
			return fc.GetTransportProtocol() == xdsfilters.RawBufferTransportProtocol
		}
		switch fc.GetTransportProtocol() {
		case xdsfilters.TLSTransportProtocol:

	Unknown     FilterChainType = "unknown"
)

func classifyFilterChain(have *listener.FilterChain) FilterChainType {
	fcm := have.GetFilterChainMatch()
	alpn := sets.New(fcm.GetApplicationProtocols()...)
	switch fcm.GetTransportProtocol() {
	case xdsfilters.TLSTransportProtocol:
		if alpn.Contains("istio-http/1.1") {
			return MTLSHTTP
		}
		if alpn.Contains("istio") {
			return MTLSTCP
		}
		return StandardTLS

	inspectors := map[int]enabledInspector{}
	for _, fc := range vi.FilterChains {
		port := fc.GetFilterChainMatch().GetDestinationPort().GetValue()
		needsTLS := fc.GetFilterChainMatch().GetTransportProtocol() == xdsfilters.TLSTransportProtocol
		needHTTP := false
		for _, ap := range fc.GetFilterChainMatch().GetApplicationProtocols() {
			// Check for HTTP protocol - these require HTTP inspector