From 4ae45b1093b1a2fda98b263a5cffce9689ad109a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ermal=20Lu=C3=A7i?= Date: Sat, 2 Aug 2008 22:24:45 +0000 Subject: Add protocol definitions needed by ipfw-classifyd. Basically they are copied from the ipfw-classifyd pfPort which inherits them from l7-filter project on sf.net. --- usr/local/share/protocols/subspace.pat | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 usr/local/share/protocols/subspace.pat (limited to 'usr/local/share/protocols/subspace.pat') diff --git a/usr/local/share/protocols/subspace.pat b/usr/local/share/protocols/subspace.pat new file mode 100644 index 0000000..57dabf1 --- /dev/null +++ b/usr/local/share/protocols/subspace.pat @@ -0,0 +1,20 @@ +# Subspace - 2D asteroids-style space game - http://sscentral.com +# Pattern attributes: marginal veryfast fast +# Protocol groups: game +# Wiki: http://www.protocolinfo.org/wiki/Subspace +# +# By Myles Uyema +# +# This pattern matches the initial 2 packets of the client-server +# 'handshake' when joining a Zone. +# +# The first packet is an 8 byte UDP payload sent from client +# 0x00 0x01 0x?? 0x?? 0x?? 0x?? 0x11 +# The next packet is a 12 byte UDP response from server +# 0x00 0x10 0x?? 0x?? 0x?? 0x?? 0x?? 0x?? 0x?? 0x?? 0x01 0x00 +# +# l7-filter strips out the null bytes, leaving me with this pattern + +subspace +^\x01....\x11\x10........\x01$ + -- cgit v1.1