1# MSN Messenger - Microsoft Network chat client 2# Pattern attributes: good slow notsofast 3# Protocol groups: chat proprietary 4# Wiki: http://www.protocolinfo.org/wiki/MSN_Messenger 5# 6# Usually uses TCP port 1863 7# http://www.hypothetic.org/docs/msn/index.php 8# http://msnpiki.msnfanatic.com/ 9# 10# This pattern has been tested and is believed to work well. 11 12msnmessenger 13 14# First branch: login 15# ver: allow versions up to 99. 16# I've never seen a cvr other than cvr0. Maybe this will be trouble later? 17# Can't anchor at the beginning because sometimes this is encapsulated in 18# HTTP. But either way, the first packet ends like this. 19# Second/Third branches: accepting/sending a message 20# I will assume that these can also be encapsulated in HTTP, although I have 21# not checked. Example of each direction: 22# ANS 1 quadong@hotmail.com 1139803431.29427 17522047 23# USR 1 quadong@hotmail.com 530423708.968145.366138 24 25# Branches are written entirely separately for better performance. 26ver [0-9]+ msnp[1-9][0-9]? [\x09-\x0d -~]*cvr0\x0d\x0a$|usr 1 [!-~]+ [0-9. ]+\x0d\x0a$|ans 1 [!-~]+ [0-9. ]+\x0d\x0a$ 27 28