mirror of
https://github.com/zeek/zeek.git
synced 2025-10-16 21:48:21 +00:00
Moved DPD signatures into script specific directories.
- This caused us to lose signatures for POP3 and Bittorrent. These will need discovered in the repository again when we add scripts for those analyzers.
This commit is contained in:
parent
841604bebe
commit
39444b5af7
19 changed files with 181 additions and 216 deletions
|
@ -4,3 +4,5 @@
|
|||
@load ./file-ident
|
||||
@load ./file-hash
|
||||
@load ./file-extract
|
||||
|
||||
@load-sigs ./dpd.sig
|
13
scripts/base/protocols/http/dpd.sig
Normal file
13
scripts/base/protocols/http/dpd.sig
Normal file
|
@ -0,0 +1,13 @@
|
|||
signature dpd_http_client {
|
||||
ip-proto == tcp
|
||||
payload /^[[:space:]]*(GET|HEAD|POST)[[:space:]]*/
|
||||
tcp-state originator
|
||||
}
|
||||
|
||||
signature dpd_http_server {
|
||||
ip-proto == tcp
|
||||
payload /^HTTP\/[0-9]/
|
||||
tcp-state responder
|
||||
requires-reverse-signature dpd_http_client
|
||||
enable "http"
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue