1# X Windows Version 11 - Networked GUI system used in most Unices 2# Pattern attributes: good notsofast fast 3# Protocol groups: remote_access x_consortium_standard 4# Wiki: http://www.protocolinfo.org/wiki/X11 5# 6# It is common for X to be tunneled through SSH. Then obviously this pattern 7# will not catch it. 8# 9# Specification: http://www.msu.edu/~huntharo/xwin/docs/xwindows/PROTO.pdf 10# Usually runs on port 6000 (6001 for the second server on a host, etc) 11# 12# This pattern has been tested. 13 14x11 15# 'l' = little-endian. 'B' = big endian 16# ".?" is for the unused byte that comes next. If it's a null, it won't appear. 17# \x0b = protocol-major-version 11. 18# For some reason, protocol-minor-version is 0, not 6, so can't match it. 19# This pattern is too general. 20^[lb].?\x0b 21userspace pattern=^[lB].?\x0b 22userspace flags=REG_NOSUB 23