1# NCP - Novell Core Protocol
2# Pattern attributes: good veryfast fast
3# Protocol groups: networking proprietary
4# Wiki: http://www.protocolinfo.org/wiki/NCP
5#
6# This pattern has been tested and is believed to work well.
7
8# ncp request
9# dmdt means Request
10#  *any length
11#
12#  *any reply buffer size
13# "" means service request
14#  | \x17\x17 means create a service connection
15#  | uu means destroy service connection
16
17# ncp reply
18# tncp means reply
19# 33 means service reply
20
21ncp
22^(dmdt.*\x01.*(""|\x11\x11|uu)|tncp.*33)
23