mirror of
https://github.com/vel21ripn/nDPI.git
synced 2026-04-28 15:09:47 +00:00
155 lines
2.2 KiB
Text
155 lines
2.2 KiB
Text
#USENET
|
|
|
|
"AUTHINFO USER "
|
|
"MODE READER\x0D\x0A"
|
|
"HELP\x0D\x0A"
|
|
|
|
#FTP_DATA
|
|
|
|
"RIFF"
|
|
"MZ\x00"
|
|
"OggS"
|
|
"PK\x03\x04"
|
|
"\x00\x00\x01\xBA"
|
|
"Rar!"
|
|
"\x1A\x45\xDF\xA3"
|
|
"\xFF\xD8"
|
|
"GIF8"
|
|
"\x3C\x3F\x70\x68"
|
|
"\x23\x21\x2F\x62"
|
|
"%PDF"
|
|
"\x89PNG"
|
|
"<htm"
|
|
"\x0A<!D"
|
|
"\x37\x7A\xBC\xAF"
|
|
"\x1F\x8B\x08"
|
|
"<!DO"
|
|
"fLaC"
|
|
"ID3\x03"
|
|
"\xFF\xFB\x90\xC0"
|
|
"\xED\xAB\xEE\xDB"
|
|
"WzPa"
|
|
"FLV\x01"
|
|
"TAPE"
|
|
"\xD0\xCF\x11\xE0"
|
|
"\x3C\x25\x40\x20"
|
|
"\x3C\x21\x2D\x2D"
|
|
"!<ar"
|
|
"<?xm"
|
|
"<iq "
|
|
"SPFI"
|
|
"ABIF"
|
|
"BZh9"
|
|
"<cf"
|
|
"<CF"
|
|
".tem"
|
|
".ite"
|
|
".lef"
|
|
|
|
#Some interesting user agent
|
|
|
|
"Azureus "
|
|
"BitTorrent"
|
|
"BTWebClient"
|
|
"Shareaza "
|
|
"Mozilla"
|
|
"Mozilla/4.0 "
|
|
"Mozilla/4.0 (compatible; MSIE 6.0;"
|
|
"BearShare Lite "
|
|
"Microsoft-Delivery-Optimization/"
|
|
"Patcher"
|
|
"AspINet"
|
|
"Valve/Steam HTTP Client"
|
|
"MacTVUP"
|
|
"Blizzard Web Client"
|
|
"Zattoo/4"
|
|
"MSRPC"
|
|
"Gnutella"
|
|
"AirControl Agent v1.0"
|
|
|
|
#HTTP methods
|
|
|
|
"OPTIONS"
|
|
"GET"
|
|
"HEAD"
|
|
"PATCH"
|
|
"POST"
|
|
"PUT"
|
|
"DELETE"
|
|
"TRACE"
|
|
"CONNECT"
|
|
"RPC_CONNECT"
|
|
"RPC_IN_DATA"
|
|
"RPC_OUT_DATA"
|
|
"MKCOL"
|
|
"MOVE"
|
|
"COPY"
|
|
"LOCK"
|
|
"UNLOCK"
|
|
"PROPFIND"
|
|
"PROPPATCH"
|
|
|
|
#HTTP Content Line
|
|
"x-application/hl7-v3+xml"
|
|
"x-application/fhir+xml"
|
|
"x-application/fhir+json"
|
|
"x-application/xml+cda"
|
|
|
|
#HTTP payload signatures
|
|
|
|
"\x4D\x5A"
|
|
"\x7F\x45\x4C\x46"
|
|
"\xCF\xFA\xED\xFE"
|
|
"#"
|
|
"!"
|
|
"/"
|
|
"\x64\x65\x78\x0A\x30\x33\x35\x00"
|
|
|
|
#Gnutella patterns
|
|
|
|
"urn:sha1:"
|
|
"HEAD /gnutella/push-proxy?"
|
|
"\x50\x55\x53\x48\x20\x67\x75\x69\x64\x3a"
|
|
"GET /gnutella/"
|
|
"\x80\x2f\x01\x03\x01\x00\x06\x00\x00\x00\x20\x00\x00\x34\x00\x00\xff\x4d\x6c"
|
|
"\x20\x4d\x6c"
|
|
"\x16\x03\x01\x00\x54\x01\x00\x00\x50\x03\x01\x4d\x6c"
|
|
"\x00\x02\x00\x34\x01\x00\x00\x05"
|
|
"\x31\x01\x00\x09\x00\x00\x00\x4c\x49\x4d\x45"
|
|
"SCP@"
|
|
"DNA@"
|
|
"\x01\x01\x54\x0f\x51\x4b\x52\x50\x06\x52"
|
|
"\x01\x01\x5c\x1b\x50\x55\x53\x48\x48\x10"
|
|
"GND\x10"
|
|
"\x31\x01\x00\x09\x00\x00\x00"
|
|
"\x00\x01\x00\x00\x00\x00\x00"
|
|
"X-Gnutella-"
|
|
"X-Queue:"
|
|
"application/x-gnutella-"
|
|
"GNUTELLA/"
|
|
"GNUTELLA CONNECT/"
|
|
|
|
#Bittorrent signatures
|
|
|
|
"Cache-Control: no-cache"
|
|
"GET /data?fid="
|
|
"Pragma: no-cache"
|
|
":target20:"
|
|
":find_node1:"
|
|
"d1:ad2:id20:"
|
|
":info_hash20:"
|
|
":filter64"
|
|
"d1:rd2:id20:"
|
|
|
|
#Jabber
|
|
|
|
"='im.truphone.com'"
|
|
"=\"im.truphone.com\""
|
|
|
|
#Mining
|
|
|
|
"\"mining.subscribe\""
|
|
"\"mining.configure\""
|
|
"zcash"
|
|
"\"agent\":\"xmr-stak-cpu"
|
|
"\"method\": \"eth_submitLogin"
|