# $Id: dsniff.magic,v 1.8 2000/07/19 03:22:02 dugsong Exp $
#
# Network protocol magic(5) for dsniff.
#
0 string FLAPON aim
0 string BEGIN\ cvs
0 string SYST ftp
0 string USER\ ftp ftp
0 string USER\ anonymous ftp
0 string HELO\ smtp
0 string EHLO\ smtp
0 string GET\ / http
0 string POST\ / http
0 string CONNECT\ http
1 string \ LOGIN\ imap
2 string \ LOGIN\ imap
3 string \ LOGIN\ imap
4 string \ LOGIN\ imap
5 string \ LOGIN\ imap
0 string NICK\ irc
0 string USER\ pop
0 string AUTH\ pop
12 string MIT-MAGIC x11
0 string LIST nntp
0 string GROUP nntp
0 string NEW nntp
0 string ARTICLE nntp
0 belong 0x7f7f4943
>4 beshort 0x4100 citrix
0 belong 0x0200e803 icq
8 belong 0x0135012c
>12 belong 0x0c010800
>>16 belong 0x7fff7f08
>>>20 belong 0x00000001 oracle
0 belong 0x0
>4 byte 0x8d pcanywhere
>5 byte 0x6 pcanywhere
132 belong 0x0301060a
>242 belong 0 tds
32 belong 0xe0031000
>36 belong 0x2c010000 tds
12 belong 100000
>4 belong 0
>>8 belong 2 portmap
12 belong 100005
>4 belong 0
>>8 belong 2 mountd
12 belong 100009
>4 belong 0
>>8 belong 2 yppasswd
16 belong 100000
>8 belong 0
>>12 belong 2 portmap
16 belong 100005
>8 belong 0
>>12 belong 2 mountd
16 belong 100009
>8 belong 0
>>12 belong 2 yppasswd
0 belong 296
>4 belong 0x20000 postgresql
0 belong 0x81000048
>33 string CACA smb
0 beshort >0xfff9
>2 byte <40
>>3 beshort >0xfff9
>>>5 byte <40 telnet
2 leshort 2
>(0.b+6) leshort 208 napster
>(0.b+6) leshort 2 napster
0 byte 0x38
>8 belong 0x00002455 mmxp
0 byte 5
>6 leshort 260
>>32 byte 0 sniffer
>6 leshort 261
>>32 lelong -1 sniffer
>1 belong 0
>>5 byte 0 icq
>(1.b+1) byte 1 socks
0 byte&0x1f 16
>2 byte&0x1f 2
>>5 byte 0x60 ldap
>4 byte&0x1f 2
>>5 beshort&0xfffc 0x0100
>>>7 byte&0x1f 4 snmp