zeek/scripts/base/protocols/dnp3/dpd.sig
Robin Sommer 36c2433075 Fixing well-known port.
This fixes the remaining test.
2013-08-11 15:59:32 -07:00

9 lines
152 B
Standard ML

# DNP3 packets always starts with 0x05 0x64 .
signature dpd_dnp3_server {
ip-proto == tcp
payload /\x05\x64/
tcp-state responder
enable "dnp3"
}