blob: 17595b85508f909f397d28bdcd7db741f2690bf8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
# Yahoo messenger - an instant messenger protocol - http://yahoo.com
# Pattern attributes: good fast fast
# Protocol groups: chat proprietary
# Wiki: http://www.protocolinfo.org/wiki/Yahoo_Messenger
# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE
#
# Usually runs on port 5050
#
# This pattern has been tested and is believed to work well.
yahoo
# http://www.venkydude.com/articles/yahoo.htm says:
# All Yahoo commands start with YMSG.
# (Well... http://ethereal.com/faq.html#q5.32 suggests that YPNS and YHOO
# are also possible, so let's allow those)
# The next 7 bytes contain command (packet?) length and version information
# which we won't currently try to match.
# L means "YAHOO_SERVICE_VERIFY" according to Ethereal
# W means "encryption challenge command" (YAHOO_SERVICE_AUTH)
# T means "login command" (YAHOO_SERVICE_AUTHRESP)
# (there are others, i.e. 0x01 "coming online", 0x02 "going offline",
# 0x04 "changing status to available", 0x06 "user message", but W and T
# should appear in the first few packets.)
# 0xC080 is the standard argument separator, it should appear not long
# after the "type of command" byte.
^(ymsg|ypns|yhoo).?.?.?.?.?.?.?[lwt].*\xc0\x80
|
