Match specific TeamSpeak 2 versions.

The version number is in the protocol, but not as a string. This will
require a match line for each version but allows us to be more specific.
This commit is contained in:
david 2013-08-05 23:52:52 +00:00
parent 52bb4806f7
commit 064430b084

View file

@ -12296,6 +12296,6 @@ ports 8767
# 180 uint8 welcome message length
# 181-435 string welcome message
match teamspeak2 m|^\xf4\xbe\x04\x00\x00\x00\x00\x00....\x02\x00\x00\x00.....([^\0]+)\0*.Win32\0*|s p/TeamSpeak 2/ i/name: $1; no password/ o/Windows/ cpe:/o:microsoft:windows/
match teamspeak2 m|^\xf4\xbe\x04\x00\x00\x00\x00\x00....\x02\x00\x00\x00.....([^\0]+)\0*.Linux\0*|s p/TeamSpeak 2/ i/name: $1; no password/ o/Linux/ cpe:/o:linux:linux_kernel/
match teamspeak2 m|^\xf4\xbe\x04\x00\x00\x00\x00\x00....\x02\x00\x00\x00.....([^\0]+)\0*.Win32\0*\x02\x00\x00\x00\x17\x00\x13\x00|s p/TeamSpeak 2/ v/2.0.23.19/ i/name: $1; no password/ o/Windows/ cpe:/o:microsoft:windows/
match teamspeak2 m|^\xf4\xbe\x04\x00\x00\x00\x00\x00....\x02\x00\x00\x00.....([^\0]+)\0*.Linux\0*\x02\x00\x00\x00\x17\x00\x13\x00|s p/TeamSpeak 2/ v/2.0.23.19/ i/name: $1; no password/ o/Linux/ cpe:/o:linux:linux_kernel/
match teamspeak2 m|^\xf4\xbe\x04\x00\x00\x00\x00\x00....\x02\x00\x00\x00....\0{60}.{356}$|s p/TeamSpeak 2/