1
0

aim.pat 1.2 KB

123456789101112131415161718192021222324252627
  1. # AIM - AOL instant messenger (OSCAR and TOC)
  2. # Pattern quality: good notsofast
  3. # Usually runs on port 5190
  4. #
  5. # This may also match ICQ traffic.
  6. #
  7. # This pattern has been tested and is believed to work well. If it does not
  8. # work for you, or you believe it could be improved, please post to
  9. # l7-filter-developers@lists.sf.net . This list may be subscribed to at
  10. # http://lists.sourceforge.net/lists/listinfo/l7-filter-developers
  11. aim
  12. # See http://gridley.acns.carleton.edu/~straitm/final (and various other places)
  13. # The first bit matches OSCAR signon and data commands, but not sure what
  14. # \x03\x0b matches, but it works apparently.
  15. # The next three bits match various parts of the TOC signon process.
  16. # The third one is the magic number "*", then 0x01 for "signon", then up to four
  17. # bytes ("up to" because l7-filter strips out nulls) which contain a sequence
  18. # number (2 bytes) the data length (2 more) and 3 nulls (which don't count),
  19. # then 0x01 for the version number (not sure if there ever has been another
  20. # version)
  21. # The fourth one is a command string, followed by some stuff, then the
  22. # beginning of the "roasted" password
  23. # This pattern is too slow!
  24. ^(\*[\x01\x02].*\x03\x0b|\*\x01.?.?.?.?\x01)|flapon|toc_signon.*0x