zeek/scripts/base/protocols/http/dpd.sig
Robin Sommer eb744fd329 Revert "Expanding the HTTP methods used in the signature to detect HTTP traffic."
This reverts commit 506b26e5ff.

The corresponding patch adding HTTP CONNECT support doesn't work yet
so backing this out until we get that in shape.
2014-02-13 12:49:46 -08:00

13 lines
281 B
Standard ML

signature dpd_http_client {
ip-proto == tcp
payload /^[[:space:]]*(GET|HEAD|POST)[[:space:]]*/
tcp-state originator
}
signature dpd_http_server {
ip-proto == tcp
payload /^HTTP\/[0-9]/
tcp-state responder
requires-reverse-signature dpd_http_client
enable "http"
}