1# TFTP - Trivial File Transfer Protocol - used for bootstrapping - RFC 1350 2# Pattern attributes: marginal veryfast fast 3# Protocol groups: document_retrieval ietf_internet_standard 4# Wiki: http://www.protocolinfo.org/wiki/TFTP 5# 6# usually runs on port 69 7# 8# This pattern is unconfirmed. 9 10tftp 11# The first packet from the initiating host should either be a Read Request 12# or a Write Request. In the other direction, it should be data packet with 13# block number one or an ACK with block number zero. We only attempt to match 14# the initiating host's packets, because the only identifying features of 15# the responses to them are two byte sequences (which isn't specific enough). 16# (\x01|\x02) = Read Request or Write Request 17# [ -~]* = the file name 18# the rest = netascii|octet|mail (case insensitivity done by the kernel) 19 20^(\x01|\x02)[ -~]*(netascii|octet|mail) 21