| 1 |
4ae45b10
|
Ermal Luçi
|
# X Windows Version 11 - Networked GUI system used in most Unices
|
| 2 |
66f2dd0e
|
Ermal Lu?i
|
# Pattern attributes: good notsofast veryfast
|
| 3 |
4ae45b10
|
Ermal Luçi
|
# Protocol groups: remote_access x_consortium_standard
|
| 4 |
|
|
# Wiki: http://www.protocolinfo.org/wiki/X11
|
| 5 |
66f2dd0e
|
Ermal Lu?i
|
# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE
|
| 6 |
4ae45b10
|
Ermal Luçi
|
#
|
| 7 |
|
|
# It is common for X to be tunneled through SSH. Then obviously this pattern
|
| 8 |
|
|
# will not catch it.
|
| 9 |
|
|
#
|
| 10 |
|
|
# Specification: http://www.msu.edu/~huntharo/xwin/docs/xwindows/PROTO.pdf
|
| 11 |
|
|
# Usually runs on port 6000 (6001 for the second server on a host, etc)
|
| 12 |
|
|
#
|
| 13 |
|
|
# This pattern has been tested.
|
| 14 |
|
|
|
| 15 |
|
|
x11
|
| 16 |
|
|
# 'l' = little-endian. 'B' = big endian
|
| 17 |
|
|
# ".?" is for the unused byte that comes next. If it's a null, it won't appear.
|
| 18 |
|
|
# \x0b = protocol-major-version 11.
|
| 19 |
|
|
# For some reason, protocol-minor-version is 0, not 6, so can't match it.
|
| 20 |
|
|
# This pattern is too general.
|
| 21 |
|
|
^[lb].?\x0b
|
| 22 |
|
|
userspace pattern=^[lB].?\x0b
|
| 23 |
|
|
userspace flags=REG_NOSUB
|