zeek/scripts/base/protocols/rfb/dpd.sig

13 lines
225 B
Standard ML

signature dpd_rfb_server {
ip-proto == tcp
payload /^RFB/
tcp-state responder
requires-reverse-signature dpd_rfb_client
enable "rfb"
}
signature dpd_rfb_client {
ip-proto == tcp
payload /^RFB/
tcp-state originator
}