zeek/scripts/base/protocols/sip/dpd.sig

5 lines
132 B
Standard ML

signature dpd_sip {
ip-proto == udp
payload /^( SIP\/[0-9]\.[0-9]\x0d\x0a|SIP\/[0-9]\.[0-9] [0-9][0-9][0-9] )/
enable "sip"
}