|
1
|
# Famatech Remote Administrator - remote desktop for MS Windows
|
|
2
|
# Pattern attributes: ok veryfast fast
|
|
3
|
# Protocol groups: remote_access proprietary
|
|
4
|
# Wiki: http://www.protocolinfo.org/wiki/Radmin
|
|
5
|
#
|
|
6
|
# This pattern has been verified with Radmin v1.1 and v3.0beta on Win2000/XP
|
|
7
|
# It has only been tested between a single pair of computers.
|
|
8
|
|
|
9
|
# The first packet of every TCP stream appears to be either one of:
|
|
10
|
#
|
|
11
|
# 01 00 00 00 01 00 00 00 08 08
|
|
12
|
# 01 00 00 00 01 00 00 00 1b 1b
|
|
13
|
|
|
14
|
radmin
|
|
15
|
^\x01\x01(\x08\x08|\x1b\x1b)$
|
|
16
|
|