usr/local/share/protocols/citrix.pat


1
2
3
4
5
6
7
8
9
10
11

# Citrix ICA - proprietary remote desktop application - http://citrix.com
# Pattern attributes: marginal notsofast notsofast
# Protocol groups: remote_access proprietary
# Wiki: http://www.protocolinfo.org/wiki/Citrix
# 
# This pattern is UNTESTED.

# This is based on decode_citrix in dsniff 2.4.

citrix
\x32\x26\x85\x92\x58