| [475ad56] | 1 | # AIM - AOL instant messenger (OSCAR and TOC)
|
|---|
| 2 | # Pattern quality: good notsofast
|
|---|
| 3 | # Usually runs on port 5190
|
|---|
| 4 | #
|
|---|
| 5 | # This may also match ICQ traffic.
|
|---|
| 6 | #
|
|---|
| 7 | # This pattern has been tested and is believed to work well. If it does not
|
|---|
| 8 | # work for you, or you believe it could be improved, please post to
|
|---|
| 9 | # l7-filter-developers@lists.sf.net . This list may be subscribed to at
|
|---|
| 10 | # http://lists.sourceforge.net/lists/listinfo/l7-filter-developers
|
|---|
| 11 |
|
|---|
| 12 | aim
|
|---|
| 13 | # See http://gridley.acns.carleton.edu/~straitm/final (and various other places)
|
|---|
| 14 | # The first bit matches OSCAR signon and data commands, but not sure what
|
|---|
| 15 | # \x03\x0b matches, but it works apparently.
|
|---|
| 16 | # The next three bits match various parts of the TOC signon process.
|
|---|
| 17 | # The third one is the magic number "*", then 0x01 for "signon", then up to four
|
|---|
| 18 | # bytes ("up to" because l7-filter strips out nulls) which contain a sequence
|
|---|
| 19 | # number (2 bytes) the data length (2 more) and 3 nulls (which don't count),
|
|---|
| 20 | # then 0x01 for the version number (not sure if there ever has been another
|
|---|
| 21 | # version)
|
|---|
| 22 | # The fourth one is a command string, followed by some stuff, then the
|
|---|
| 23 | # beginning of the "roasted" password
|
|---|
| 24 |
|
|---|
| 25 | # This pattern is too slow!
|
|---|
| 26 |
|
|---|
| 27 | ^(\*[\x01\x02].*\x03\x0b|\*\x01.?.?.?.?\x01)|flapon|toc_signon.*0x
|
|---|
