|
1
|
# NCP - Novell Core Protocol
|
|
2
|
# Pattern attributes: good fast fast
|
|
3
|
# Protocol groups: networking proprietary
|
|
4
|
# Wiki: http://www.protocolinfo.org/wiki/NCP
|
|
5
|
# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE
|
|
6
|
#
|
|
7
|
# This pattern has been tested and is believed to work well.
|
|
8
|
|
|
9
|
# ncp request
|
|
10
|
# dmdt means Request
|
|
11
|
# *any length
|
|
12
|
#
|
|
13
|
# *any reply buffer size
|
|
14
|
# "" means service request
|
|
15
|
# | \x17\x17 means create a service connection
|
|
16
|
# | uu means destroy service connection
|
|
17
|
|
|
18
|
# ncp reply
|
|
19
|
# tncp means reply
|
|
20
|
# 33 means service reply
|
|
21
|
|
|
22
|
ncp
|
|
23
|
^(dmdt.*\x01.*(""|\x11\x11|uu)|tncp.*33)
|