[prev in list] [next in list] [prev in thread] [next in thread] 

List:       l7-filter-developers
Subject:    Re: [l7-filter-developers] MSN Messenger Pattern Don't Work
From:       Matthew Strait <quadong () users ! sourceforge ! net>
Date:       2006-01-18 1:23:02
Message-ID: Pine.LNX.4.64.0601171916190.5642 () mattdesk ! strait
[Download RAW message or body]

>>>> Mathew, i believe that the problem is the messenger 7.5.

> OK, i have captured the packets with ethereal and this is the part of the
> msn protocol:
>
> 0000   00 90 96 74 1d e7 00 e0 7d a2 4f 0a 08 00 45 00  ...t....}.O...E.
> 0010   00 49 42 a2 40 00 80 06 c5 9b c0 a8 01 06 41 36  .IB.@.........A6
> 0020   ef 8c 04 f5 07 47 89 54 b5 de 25 d1 8f 0a 50 18  .....G.T..%...P.
> 0030   ff ff a4 30 00 00 56 45 52 20 31 20 4d 53 4e 50  ...0..VER 1 MSNP
> 0040   31 32 20 4d 53 4e 50 31 31 20 4d 53 4e 50 31 30  12 MSNP11 MSNP10
> 0050   20 43 56 52 30 0d 0a                              CVR0..
>
> and a raw data is:
>
> VER 1 MSNP12 MSNP11 MSNP10 CVR0
> | --> blank line

This data should be matched by the current pattern, unless I'm missing 
something.  It is:

^(ver [0-9]+ msnp[1-9][0-9]? [\x09-\x0d -~]* cvr|usr md5 i [ -~]*)

The first branch is:

^ver [0-9]+ msnp[1-9][0-9]? [\x09-\x0d -~]* cvr
    \    \       |            /              /
     \    \      |   ________/__     _______/
      \    |     |  /           \   /
       VER 1 MSNP12 MSNP11 MSNP10 CVR0

Are you sure:

- Everything is set up right?
- The data you have sent me is at the beginning of the connection?
- The pattern works for you with MSN Messenger 7.0 but not 7.5? (It works 
for me with 7.0.)

-Matthew


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
L7-filter-developers mailing list
L7-filter-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/l7-filter-developers
[prev in list] [next in list] [prev in thread] [next in thread]