zeek/scripts/policy/protocols/smb/dpd.sig
Seth Hall 134d0922d5 Move the SMB analyzer out of the default load.
This also adds a note in the local.bro script about enabling
the SMB analyzer.
2016-06-14 15:34:00 -04:00

5 lines
No EOL
82 B
Standard ML

signature dpd_smb {
ip-proto == tcp
payload /^....[\xfe\xff]SMB/
enable "smb"
}