zeek/scripts/base/protocols/sip/dpd.sig
Seth Hall 94afcd89c0 Small update for the SIP logs and DPD sig.
The logs were incomplete for intermediate 1xx responses.
2015-04-17 21:46:56 -04:00

5 lines
116 B
Standard ML

signature dpd_sip {
ip-proto == udp
payload /^ ?SIP\/[0-9]\.[0-9](\x0d\x0a| [0-9][0-9][0-9] )/
enable "sip"
}