zeek/scripts/base/protocols/http/dpd.sig
Seth Hall 39444b5af7 Moved DPD signatures into script specific directories.
- This caused us to lose signatures for POP3 and Bittorrent.  These will
   need discovered in the repository again when we add scripts
   for those analyzers.
2013-07-09 22:44:55 -04:00

13 lines
281 B
Standard ML

signature dpd_http_client {
ip-proto == tcp
payload /^[[:space:]]*(GET|HEAD|POST)[[:space:]]*/
tcp-state originator
}
signature dpd_http_server {
ip-proto == tcp
payload /^HTTP\/[0-9]/
tcp-state responder
requires-reverse-signature dpd_http_client
enable "http"
}