blob: d13aa65bdae14c643c1dcba5ed0681a07b081e91 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
# Famatech Remote Administrator - remote desktop for MS Windows
# Pattern attributes: ok veryfast fast
# Protocol groups: remote_access proprietary
# Wiki: http://www.protocolinfo.org/wiki/Radmin
# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE
#
# This pattern has been verified with Radmin v1.1 and v3.0beta on Win2000/XP
# It has only been tested between a single pair of computers.
# The first packet of every TCP stream appears to be either one of:
#
# 01 00 00 00 01 00 00 00 08 08
# 01 00 00 00 01 00 00 00 1b 1b
radmin
^\x01\x01(\x08\x08|\x1b\x1b)$
|
