mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
5b32791edb
* origin/topic/vladg/sip: Update NEWS. Update baselines. Spruce up SIP events.bif documentation a bit. Register SIP analyzer to well known port. Fix indenting issue in main.bro Add SIP btests. Small update for the SIP logs and DPD sig. SIP: Fix up DPD and the TCP analyzer a bit. SIP: Move to the new string BIFs SIP: Move to new analyzer format. Move the SIP analyzer to uint64 sequences, and a number of other small SIP fixes. Rely on content inspection and not just is_orig to determine client/server. Enable SIP in CMakeLists.txt Merge topic/seth/faf-updates. BIT-1370 #merged
19 lines
420 B
Standard ML
19 lines
420 B
Standard ML
signature dpd_sip_udp_req {
|
|
ip-proto == udp
|
|
payload /.* SIP\/[0-9]\.[0-9]\x0d\x0a/
|
|
enable "sip"
|
|
}
|
|
|
|
signature dpd_sip_udp_resp {
|
|
ip-proto == udp
|
|
payload /^ ?SIP\/[0-9]\.[0-9](\x0d\x0a| [0-9][0-9][0-9] )/
|
|
enable "sip"
|
|
}
|
|
|
|
# We don't support SIP-over-TCP yet.
|
|
#
|
|
# signature dpd_sip_tcp {
|
|
# ip-proto == tcp
|
|
# payload /^( SIP\/[0-9]\.[0-9]\x0d\x0a|SIP\/[0-9]\.[0-9] [0-9][0-9][0-9] )/
|
|
# enable "sip_tcp"
|
|
# }
|