freewrt_1_0
freewrt_2_0
| Rev | Line | |
|---|
| [475ad56] | 1 | # eDonkey2000 - P2P filesharing - http://edonkey2000.com
|
|---|
| 2 | # Pattern quality: good veryfast overmatch
|
|---|
| 3 | #
|
|---|
| 4 | # Please post to l7-filter-developers@lists.sf.net as to whether this pattern
|
|---|
| 5 | # works for you or not. If you believe it could be improved please post your
|
|---|
| 6 | # suggestions to that list as well. You may subscribe to this list at
|
|---|
| 7 | # http://lists.sourceforge.net/lists/listinfo/l7-filter-developers
|
|---|
| 8 |
|
|---|
| 9 | # Thanks to Matt Skidmore <fox AT woozle.org>
|
|---|
| 10 |
|
|---|
| 11 | edonkey
|
|---|
| 12 |
|
|---|
| 13 | # http://gd.tuwien.ac.at/opsys/linux/sf/p/pdonkey/eDonkey-protocol-0.6
|
|---|
| 14 | #
|
|---|
| 15 | # In addition to \xe3, \xc5 and \xd4, I see a lot of \xe5
|
|---|
| 16 | #
|
|---|
| 17 | # God this is a mess. What an irritating protocol.
|
|---|
| 18 | # This will match about 1% of streams with random data in them!
|
|---|
| 19 |
|
|---|
| 20 | ^[\xe3\xc5\xe5\xd4](....)?([\x01\x02\x05\x14\x15\x16\x18\x19\x1a\x1b\x1c\x20\x21\x32\x33\x34\x35\x36\x38\x40\x41\x42\x43\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x5b\x5c\x60\x81\x82\x90\x91\x93\x96\x97\x98\x99\x9a\x9b\x9c\x9e\xa0\xa1\xa2\xa3\xa4]|\x59................?[ -~]|\x96....$)
|
|---|
| 21 |
|
|---|
| 22 | # matches everything and too much
|
|---|
| 23 | # ^(\xe3|\xc5|\xd4)
|
|---|
| 24 |
|
|---|
| 25 | # ipp2p essentially uses "\xe3....\x47", which doesn't seem at all right to me.
|
|---|
| 26 |
|
|---|
| 27 | # bandwidtharbitrator uses
|
|---|
| 28 | # e0.*@.*6[a-z].*p$|e0.*@.*[a-z]6[a-z].*p0$|e.*@.*[0-9]6.*p$|emule|edonkey
|
|---|
| 29 | # no comments to explain what all the mush is, of course...
|
|---|
Note:
See
TracBrowser
for help on using the repository browser.
