2005-11-18 16:17:27 +00:00
|
|
|
# Bittorrent - P2P filesharing / publishing tool - http://www.bittorrent.com
|
2009-05-01 15:20:34 +00:00
|
|
|
# Pattern attributes: good slow594 notsofast undermatch
|
2007-11-19 23:07:00 +00:00
|
|
|
# Protocol groups: p2p open_source
|
|
|
|
|
# Wiki: http://www.protocolinfo.org/wiki/Bittorrent
|
2009-05-01 15:20:34 +00:00
|
|
|
# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE
|
2005-11-18 16:17:27 +00:00
|
|
|
#
|
2007-11-19 23:07:00 +00:00
|
|
|
# This pattern has been tested and is believed to work well.
|
|
|
|
|
# It will, however, not work on bittorrent streams that are encrypted, since
|
2009-05-01 15:20:34 +00:00
|
|
|
# it's impossible to match (well) encrypted data.
|
2007-11-19 23:07:00 +00:00
|
|
|
|
2005-11-18 16:17:27 +00:00
|
|
|
bittorrent
|
|
|
|
|
|
|
|
|
|
# Does not attempt to match the HTTP download of the tracker
|
|
|
|
|
# 0x13 is the length of "bittorrent protocol"
|
2007-11-19 23:07:00 +00:00
|
|
|
# Second two bits match UDP wierdness
|
|
|
|
|
# Next bit matches something Azureus does
|
|
|
|
|
# Ditto on the next bit. Could also match on "user-agent: azureus", but that's in the next
|
|
|
|
|
# packet and perhaps this will match multiple clients.
|
2009-05-01 15:20:34 +00:00
|
|
|
# bitcomet-specific strings contributed by liangjun.
|
2007-11-19 23:07:00 +00:00
|
|
|
|
|
|
|
|
# This is not a valid GNU basic regular expression (but that's ok).
|
2009-05-01 15:20:34 +00:00
|
|
|
^(\x13bittorrent protocol|azver\x01$|get /scrape\?info_hash=get /announce\?info_hash=|get /client/bitcomet/|GET /data\?fid=)|d1:ad2:id20:|\x08'7P\)[RP]
|
2007-11-19 23:07:00 +00:00
|
|
|
|
|
|
|
|
# This pattern is "fast", but won't catch as much
|
|
|
|
|
#^(\x13bittorrent protocol|azver\x01$|get /scrape\?info_hash=)
|
