1# MSN file transfers - MSN (Micosoft Network) Messenger file transfers (MSNFTP and MSNSLP) 2# Pattern attributes: good veryfast fast 3# Protocol groups: chat document_retrieval proprietary 4# Wiki: http://www.protocolinfo.org/wiki/MSN_Messenger 5# 6# http://www.hypothetic.org/docs/msn/client/file_transfer.php 7 8# NOTE! This pattern does not catch the modern type of MSN filetransfers 9# because they use the same TCP connection as the chat itself. See 10# ../example_traffic/msn_chat_and_file_transfer.txt for a demonstration. 11 12# This pattern has been tested and seems to work well. It, does, 13# however, require more testing with various versions of the official 14# MSN client as well as with clones such as Trillian, Miranda, Gaim, 15# etc. If you are using a MSN clone and this pattern DOES work for you, 16# please, also let us know. 17 18# First part matches the older MSNFTP: A MSN filetransfer is a normal 19# MSN connection except that the protocol is MSNFTP. Some clients 20# (especially Trillian) send other protocol versions besides MSNFTP 21# which should be matched by the [ -~]*. 22 23# Second part matches newer MSNSLP: 24# http://msnpiki.msnfanatic.com/index.php/MSNC:MSNSLP 25# This part is untested. 26 27msn-filetransfer 28^(ver [ -~]*msnftp\x0d\x0aver msnftp\x0d\x0ausr|method msnmsgr:) 29 30