mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
39444b5af7
- This caused us to lose signatures for POP3 and Bittorrent. These will need discovered in the repository again when we add scripts for those analyzers.
14 lines
288 B
Standard ML
14 lines
288 B
Standard ML
# Provide DPD signatures for tunneling protocols that otherwise
|
|
# wouldn't be detected at all.
|
|
|
|
signature dpd_ayiya {
|
|
ip-proto = udp
|
|
payload /^..\x11\x29/
|
|
enable "ayiya"
|
|
}
|
|
|
|
signature dpd_teredo {
|
|
ip-proto = udp
|
|
payload /^(\x00\x00)|(\x00\x01)|([\x60-\x6f])/
|
|
enable "teredo"
|
|
}
|