mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
a9867c706d
Contributed by Martina Balint in https://github.com/bro/bro/pull/39. (I didn't merge the github branch, as that has some more stuff in its history. Instead I applied the single-line change directly.)
14 lines
361 B
Standard ML
14 lines
361 B
Standard ML
# Provide DPD signatures for tunneling protocols that otherwise
|
|
# wouldn't be detected at all.
|
|
|
|
signature dpd_ayiya {
|
|
ip-proto = udp
|
|
payload /^..\x11\x29/
|
|
enable "ayiya"
|
|
}
|
|
|
|
signature dpd_teredo {
|
|
ip-proto = udp
|
|
payload /^(\x00\x00)|(\x00\x01)|([\x60-\x6f].{7}((\x20\x01\x00\x00)).{28})|([\x60-\x6f].{23}((\x20\x01\x00\x00))).{12}/
|
|
enable "teredo"
|
|
}
|