|
1
|
# NNTP - Network News Transfer Protocol - RFCs 977 and 2980
|
|
2
|
# Pattern attributes: good veryfast fast
|
|
3
|
# Protocol groups: ietf_proposed_standard
|
|
4
|
# Wiki: http://www.protocolinfo.org/wiki/NNTP
|
|
5
|
#
|
|
6
|
# usually runs on port 119
|
|
7
|
|
|
8
|
# This pattern is tested and is believed to work well (but could use
|
|
9
|
# more testing).
|
|
10
|
|
|
11
|
nntp
|
|
12
|
# matches authorized login
|
|
13
|
# OR
|
|
14
|
# matches unauthorized login if the server says "news" after 200/201
|
|
15
|
# (Half of the 2 servers I tested did :-), but they both required authorization
|
|
16
|
# so it's quite possible that this pattern will miss some nntp traffic.)
|
|
17
|
^(20[01][\x09-\x0d -~]*AUTHINFO USER|20[01][\x09-\x0d -~]*news)
|
|
18
|
|
|
19
|
# same thing, slightly more accurate, but 100+ times slower
|
|
20
|
#^20[01][\x09-\x0d -~]*\x0d\x0a[\x09-\x0d -~]*AUTHINFO USER|20[01][\x09-\x0d -~]*news
|