Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 22:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

spicy-redis: Add dpd signature and clean pcaps

Browse source
This commit is contained in:
Evan Typanski 2024-11-26 11:13:12 -05:00
parent f0e9f46c7c
commit 7f28ec8bc5
66 changed files with 572 additions and 554 deletions
Download patch file Download diff file Expand all files Collapse all files

16
scripts/base/protocols/redis/dpd.sig Normal file
View file

@ -0,0 +1,16 @@
signature resp-client {
ip-proto == tcp
payload /^.*\r\n/
tcp-state originator
requires-reverse-signature resp-serialized-server
event "Found possible Redis client data"
enable "spicy_Redis"
}
signature resp-serialized-server {
ip-proto == tcp
payload /^([-+_,].*\r\n|[:$*#(!=%`~>][+-]?[0-9]+(\.[0-9]*)?\r\n)/
tcp-state responder
event "Found Redis server data"
enable "spicy_Redis"
}