| 1 |
4ae45b10
|
Ermal Luçi
|
# TFTP - Trivial File Transfer Protocol - used for bootstrapping - RFC 1350
|
| 2 |
66f2dd0e
|
Ermal Lu?i
|
# Pattern attributes: marginal fast fast
|
| 3 |
4ae45b10
|
Ermal Luçi
|
# Protocol groups: document_retrieval ietf_internet_standard
|
| 4 |
|
|
# Wiki: http://www.protocolinfo.org/wiki/TFTP
|
| 5 |
66f2dd0e
|
Ermal Lu?i
|
# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE
|
| 6 |
4ae45b10
|
Ermal Luçi
|
#
|
| 7 |
|
|
# usually runs on port 69
|
| 8 |
|
|
#
|
| 9 |
|
|
# This pattern is unconfirmed.
|
| 10 |
|
|
|
| 11 |
|
|
tftp
|
| 12 |
|
|
# The first packet from the initiating host should either be a Read Request
|
| 13 |
|
|
# or a Write Request. In the other direction, it should be data packet with
|
| 14 |
|
|
# block number one or an ACK with block number zero. We only attempt to match
|
| 15 |
|
|
# the initiating host's packets, because the only identifying features of
|
| 16 |
|
|
# the responses to them are two byte sequences (which isn't specific enough).
|
| 17 |
|
|
# (\x01|\x02) = Read Request or Write Request
|
| 18 |
|
|
# [ -~]* = the file name
|
| 19 |
|
|
# the rest = netascii|octet|mail (case insensitivity done by the kernel)
|
| 20 |
|
|
|
| 21 |
|
|
^(\x01|\x02)[ -~]*(netascii|octet|mail)
|