blob: 5ffddfc3c20128b0ef7ca80c75db298ca6b085d3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
|
# MSN (Micosoft Network) Messenger file transfers (MSNFTP and MSNSLP)
# Pattern attributes: good veryfast fast
# Protocol groups: chat document_retrieval proprietary
# Wiki: http://www.protocolinfo.org/wiki/MSN_Messenger
#
# http://www.hypothetic.org/docs/msn/client/file_transfer.php
# NOTE! This pattern does not catch the modern type of MSN filetransfers
# because they use the same TCP connection as the chat itself. See
# ../example_traffic/msn_chat_and_file_transfer.txt for a demonstration.
# This pattern has been tested and seems to work well. It, does,
# however, require more testing with various versions of the official
# MSN client as well as with clones such as Trillian, Miranda, Gaim,
# etc. If you are using a MSN clone and this pattern DOES work for you,
# please, also let us know.
# First part matches the older MSNFTP: A MSN filetransfer is a normal
# MSN connection except that the protocol is MSNFTP. Some clients
# (especially Trillian) send other protocol versions besides MSNFTP
# which should be matched by the [ -~]*.
# Second part matches newer MSNSLP:
# http://msnpiki.msnfanatic.com/index.php/MSNC:MSNSLP
# This part is untested.
msn-filetransfer
^(ver [ -~]*msnftp\x0d\x0aver msnftp\x0d\x0ausr|method msnmsgr:)
|
