| 1 | /* |
|---|
| 2 | * L7-filter Supported Protocols |
|---|
| 3 | */ |
|---|
| 4 | /* |
|---|
| 5 | * 2007-11-22 |
|---|
| 6 | */ |
|---|
| 7 | |
|---|
| 8 | typedef struct _l7filters // l7 and p2p filters |
|---|
| 9 | { |
|---|
| 10 | |
|---|
| 11 | char *name; |
|---|
| 12 | |
|---|
| 13 | char *protocol; |
|---|
| 14 | |
|---|
| 15 | } l7filters; |
|---|
| 16 | |
|---|
| 17 | //Added , (in extra), dazhihui, . |
|---|
| 18 | |
|---|
| 19 | l7filters filters_list[] = { |
|---|
| 20 | |
|---|
| 21 | { |
|---|
| 22 | "100bao", "l7"}, // 100bao - a Chinese P2P protocol/program - |
|---|
| 23 | // http://www.100bao.com |
|---|
| 24 | { |
|---|
| 25 | "aim", "l7"}, // AIM - AOL instant messenger (OSCAR and |
|---|
| 26 | // TOC) |
|---|
| 27 | { |
|---|
| 28 | "aimwebcontent", "l7"}, // AIM web content - ads/news content |
|---|
| 29 | // downloaded by AOL Instant Messenger |
|---|
| 30 | { |
|---|
| 31 | "applejuice", "p2p"}, // Apple Juice - P2P filesharing - |
|---|
| 32 | // http://www.applejuicenet.de |
|---|
| 33 | { |
|---|
| 34 | "ares", "p2p"}, // Ares - P2P filesharing - |
|---|
| 35 | // http://aresgalaxy.sf.net |
|---|
| 36 | { |
|---|
| 37 | "armagetron", "l7"}, // Armagetron Advanced - open source |
|---|
| 38 | // Tron/snake based multiplayer game |
|---|
| 39 | { |
|---|
| 40 | "audiogalaxy", "l7"}, // Audiogalaxy - (defunct) Peer to Peer |
|---|
| 41 | // filesharing |
|---|
| 42 | { |
|---|
| 43 | "battlefield1942", "l7"}, // Battlefield 1942 - An EA game |
|---|
| 44 | { |
|---|
| 45 | "battlefield2", "l7"}, // Battlefield 2 - An EA game. |
|---|
| 46 | { |
|---|
| 47 | "battlefield2142", "l7"}, // Battlefield 2142 - An EA game. |
|---|
| 48 | { |
|---|
| 49 | "bgp", "l7"}, // BGP - Border Gateway Protocol - RFC 1771 |
|---|
| 50 | { |
|---|
| 51 | "biff", "l7"}, // Biff - new mail notification |
|---|
| 52 | { |
|---|
| 53 | "bittorrent", "p2p"}, // Bittorrent - P2P filesharing / publishing |
|---|
| 54 | // tool - http://www.bittorrent.com |
|---|
| 55 | { |
|---|
| 56 | "chikka", "l7"}, // Chikka - SMS service which can be used |
|---|
| 57 | // without phones - http://chikka.com |
|---|
| 58 | { |
|---|
| 59 | "cimd", "l7"}, // Computer Interface to Message |
|---|
| 60 | // Distribution, an SMSC protocol by Nokia |
|---|
| 61 | { |
|---|
| 62 | "ciscovpn", "l7"}, // Cisco VPN - VPN client software to a Cisco |
|---|
| 63 | // VPN server |
|---|
| 64 | { |
|---|
| 65 | "citrix", "l7"}, // Citrix ICA - proprietary remote desktop |
|---|
| 66 | // application - http://citrix.com |
|---|
| 67 | { |
|---|
| 68 | "code_red", "l7"}, // Code Red - a worm that attacks Microsoft |
|---|
| 69 | // IIS web servers |
|---|
| 70 | { |
|---|
| 71 | "counterstrike-source", "l7"}, // Counterstrike (using the new |
|---|
| 72 | // "Source" engine) - network game |
|---|
| 73 | { |
|---|
| 74 | "cvs", "l7"}, // CVS - Concurrent Versions System |
|---|
| 75 | { |
|---|
| 76 | "dayofdefeat-source", "l7"}, // Day of Defeat: Source - game |
|---|
| 77 | // (Half-Life 2 mod) - |
|---|
| 78 | // http://www.valvesoftware.com |
|---|
| 79 | { |
|---|
| 80 | "dazhihui", "l7"}, |
|---|
| 81 | { |
|---|
| 82 | "dhcp", "l7"}, // DHCP - Dynamic Host Configuration Protocol |
|---|
| 83 | // - RFC 1541 |
|---|
| 84 | { |
|---|
| 85 | "directconnect", "p2p"}, // Direct Connect - P2P filesharing - |
|---|
| 86 | // http://www.neo-modus.com |
|---|
| 87 | { |
|---|
| 88 | "dns", "l7"}, // DNS - Domain Name System - RFC 1035 |
|---|
| 89 | { |
|---|
| 90 | "doom3", "l7"}, // Doom 3 - computer game |
|---|
| 91 | { |
|---|
| 92 | "edonkey", "p2p"}, // eDonkey2000 - P2P filesharing - |
|---|
| 93 | // http://edonkey2000.com and others |
|---|
| 94 | { |
|---|
| 95 | "exe", "l7"}, // Executable - Microsoft PE file format. |
|---|
| 96 | { |
|---|
| 97 | "fasttrack", "l7"}, // FastTrack - P2P filesharing (Kazaa, |
|---|
| 98 | // Morpheus, iMesh, Grokster, etc) |
|---|
| 99 | { |
|---|
| 100 | "finger", "l7"}, // Finger - User information server - RFC |
|---|
| 101 | // 1288 |
|---|
| 102 | { |
|---|
| 103 | "flash", "l7"}, // Flash - Macromedia Flash. |
|---|
| 104 | { |
|---|
| 105 | "freenet", "l7"}, // Freenet - Anonymous information retrieval |
|---|
| 106 | // - http://freenetproject.org |
|---|
| 107 | { |
|---|
| 108 | "ftp", "l7"}, // FTP - File Transfer Protocol - RFC 959 |
|---|
| 109 | { |
|---|
| 110 | "gif", "l7"}, // GIF - Popular Image format. |
|---|
| 111 | { |
|---|
| 112 | "gkrellm", "l7"}, // Gkrellm - a system monitor - |
|---|
| 113 | // http://gkrellm.net |
|---|
| 114 | { |
|---|
| 115 | "gnucleuslan", "l7"}, // GnucleusLAN - LAN-only P2P filesharing |
|---|
| 116 | { |
|---|
| 117 | "gnutella", "p2p"}, // Gnutella - P2P filesharing |
|---|
| 118 | { |
|---|
| 119 | "goboogy", "l7"}, // GoBoogy - a Korean P2P protocol |
|---|
| 120 | { |
|---|
| 121 | "gopher", "l7"}, // Gopher - A precursor to HTTP - RFC 1436 |
|---|
| 122 | { |
|---|
| 123 | "gtalk", "l7"}, |
|---|
| 124 | { |
|---|
| 125 | "guildwars", "l7"}, // Guild Wars - online game - http://guildwars.com |
|---|
| 126 | { |
|---|
| 127 | "h323", "l7"}, // H.323 - Voice over IP. |
|---|
| 128 | { |
|---|
| 129 | "halflife2-deathmatch", "l7"}, // Half-Life 2 Deathmatch - popular |
|---|
| 130 | // computer game |
|---|
| 131 | { |
|---|
| 132 | "hddtemp", "l7"}, // hddtemp - Hard drive temperature |
|---|
| 133 | // reporting |
|---|
| 134 | { |
|---|
| 135 | "hotline", "l7"}, // Hotline - An old P2P filesharing protocol |
|---|
| 136 | { |
|---|
| 137 | "html", "l7"}, // (X)HTML - (Extensible) Hypertext Markup |
|---|
| 138 | // Language - http://w3.org |
|---|
| 139 | { |
|---|
| 140 | "http-rtsp", "l7"}, // RTSP tunneled within HTTP |
|---|
| 141 | { |
|---|
| 142 | "http", "l7"}, // HTTP - HyperText Transfer Protocol - RFC |
|---|
| 143 | // 2616 |
|---|
| 144 | { |
|---|
| 145 | "http-dap", "l7"}, // HTTP by Download Accelerator Plus - |
|---|
| 146 | // http://www.speedbit.com |
|---|
| 147 | { |
|---|
| 148 | "http-freshdownload", "l7"}, // HTTP by Fresh Download - |
|---|
| 149 | // http://www.freshdevices.com |
|---|
| 150 | { |
|---|
| 151 | "http-itunes", "l7"}, // HTTP - iTunes (Apple's music program) |
|---|
| 152 | { |
|---|
| 153 | "httpaudio", "l7"}, // HTTP - Audio over HyperText Transfer |
|---|
| 154 | // Protocol (RFC 2616) |
|---|
| 155 | { |
|---|
| 156 | "httpcachehit", "l7"}, // HTTP - Proxy Cache hit for HyperText |
|---|
| 157 | // Transfer Protocol (RFC 2616) |
|---|
| 158 | { |
|---|
| 159 | "httpcachemiss", "l7"}, // HTTP - Proxy Cache miss for HyperText |
|---|
| 160 | // Transfer Protocol (RFC 2616) |
|---|
| 161 | { |
|---|
| 162 | "httpvideo", "l7"}, // HTTP - Video over HyperText Transfer |
|---|
| 163 | // Protocol (RFC 2616) |
|---|
| 164 | { |
|---|
| 165 | "ident", "l7"}, // Ident - Identification Protocol - RFC |
|---|
| 166 | // 1413 |
|---|
| 167 | { |
|---|
| 168 | "imap", "l7"}, // IMAP - Internet Message Access Protocol (A |
|---|
| 169 | // common e-mail protocol) |
|---|
| 170 | { |
|---|
| 171 | "imesh", "l7"}, // iMesh - the native protocol of iMesh, a |
|---|
| 172 | // P2P application - http://imesh.com |
|---|
| 173 | { |
|---|
| 174 | "ipp", "l7"}, // IP printing - a new standard for UNIX |
|---|
| 175 | // printing - RFC 2911 |
|---|
| 176 | { |
|---|
| 177 | "irc", "l7"}, // IRC - Internet Relay Chat - RFC 1459 |
|---|
| 178 | { |
|---|
| 179 | "jabber", "l7"}, // Jabber (XMPP) - open instant messenger |
|---|
| 180 | // protocol - RFC 3920 - http://jabber.org |
|---|
| 181 | { |
|---|
| 182 | "jpeg", "l7"}, // JPEG - Joint Picture Expert Group image |
|---|
| 183 | // format. |
|---|
| 184 | { |
|---|
| 185 | "kugoo", "l7"}, // KuGoo - a Chinese P2P program - |
|---|
| 186 | // http://www.kugoo.com |
|---|
| 187 | { |
|---|
| 188 | "live365", "l7"}, // live365 - An Internet radio site - |
|---|
| 189 | // http://live365.com |
|---|
| 190 | { |
|---|
| 191 | "liveforspeed", "l7"}, // Live For Speed - A racing game. |
|---|
| 192 | { |
|---|
| 193 | "lpd", "l7"}, // LPD - Line Printer Daemon Protocol |
|---|
| 194 | // (old-style UNIX printing) - RFC 1179 |
|---|
| 195 | { |
|---|
| 196 | "mohaa", "l7"}, // Medal of Honor Allied Assault - an |
|---|
| 197 | // Electronic Arts game |
|---|
| 198 | { |
|---|
| 199 | "mp3", "L7"}, // MP3 - Moving Picture Experts Group Audio |
|---|
| 200 | // Layer III |
|---|
| 201 | { |
|---|
| 202 | "msn-filetransfer", "l7"}, // MSN (Micosoft Network) Messenger file |
|---|
| 203 | // transfers (MSNFTP and MSNSLP) |
|---|
| 204 | { |
|---|
| 205 | "msnmessenger", "l7"}, // MSN Messenger - Microsoft Network chat |
|---|
| 206 | // client |
|---|
| 207 | { |
|---|
| 208 | "mute", "p2p"}, // MUTE - P2P filesharing - |
|---|
| 209 | // http://mute-net.sourceforge.net |
|---|
| 210 | { |
|---|
| 211 | "napster", "l7"}, // Napster - P2P filesharing |
|---|
| 212 | { |
|---|
| 213 | "nbns", "l7"}, // NBNS - NetBIOS name service |
|---|
| 214 | { |
|---|
| 215 | "ncp", "l7"}, // NCP - Novell Core Protocol |
|---|
| 216 | { |
|---|
| 217 | "netbios", "l7"}, // NetBIOS - Network Basic Input Output |
|---|
| 218 | // System |
|---|
| 219 | { |
|---|
| 220 | "nimda", "l7"}, // Nimda - a worm that attacks Microsoft IIS |
|---|
| 221 | // web servers, and MORE! |
|---|
| 222 | { |
|---|
| 223 | "nntp", "l7"}, // NNTP - Network News Transfer Protocol - |
|---|
| 224 | // RFCs 977 and 2980 |
|---|
| 225 | { |
|---|
| 226 | "ntp", "l7"}, // (S)NTP - (Simple) Network Time Protocol - |
|---|
| 227 | // RFCs 1305 and 2030 |
|---|
| 228 | { |
|---|
| 229 | "ogg", "l7"}, // Ogg - Ogg Vorbis music format (not any ogg |
|---|
| 230 | // file, just vorbis) |
|---|
| 231 | { |
|---|
| 232 | "openft", "l7"}, // OpenFT - P2P filesharing (implemented in |
|---|
| 233 | // giFT library) |
|---|
| 234 | { |
|---|
| 235 | "pcanywhere", "l7"}, // pcAnywhere - Symantec remote access |
|---|
| 236 | // program |
|---|
| 237 | { |
|---|
| 238 | "pdf", "l7"}, // PDF - Portable Document Format - |
|---|
| 239 | // Postscript-like format by Adobe |
|---|
| 240 | { |
|---|
| 241 | "perl", "l7"}, // Perl - A scripting language by Larry |
|---|
| 242 | // Wall. |
|---|
| 243 | { |
|---|
| 244 | "poco", "l7"}, // POCO and PP365 - Chinese P2P filesharing - |
|---|
| 245 | // http://pp365.com http://poco.cn |
|---|
| 246 | { |
|---|
| 247 | "png", "l7"}, // PNG - Portable Network Graphics, a popular |
|---|
| 248 | // image format |
|---|
| 249 | { |
|---|
| 250 | "pop3", "l7"}, // POP3 - Post Office Protocol version 3 |
|---|
| 251 | // (popular e-mail protocol) - RFC 1939 |
|---|
| 252 | { |
|---|
| 253 | "postscript", "l7"}, // Postscript - Printing Language |
|---|
| 254 | { |
|---|
| 255 | "pplive", "l7"}, // PPLive - Chinese P2P streaming video - http://pplive.com |
|---|
| 256 | { |
|---|
| 257 | "pressplay", "l7"}, // pressplay - A legal music distribution |
|---|
| 258 | { |
|---|
| 259 | "qq", "l7"}, // Tencent QQ Protocol - Chinese instant |
|---|
| 260 | // messenger protocol - http://www.qq.com |
|---|
| 261 | // site - http://pressplay.com |
|---|
| 262 | { |
|---|
| 263 | "quake-halflife", "l7"}, // Half Life 1 engine games (HL 1, Quake |
|---|
| 264 | // 2/3/World, Counterstrike 1.6, etc.) |
|---|
| 265 | { |
|---|
| 266 | "quake1", "l7"}, // Quake 1 - A popular computer game. |
|---|
| 267 | { |
|---|
| 268 | "quicktime", "l7"}, // Quicktime HTTP |
|---|
| 269 | { |
|---|
| 270 | "radmin", "l7"}, // Famatech Remote Administrator - remote |
|---|
| 271 | // desktop for MS Windows |
|---|
| 272 | { |
|---|
| 273 | "rar", "l7"}, // RAR - The WinRAR archive format |
|---|
| 274 | { |
|---|
| 275 | "rdp", "l7"}, // RDP - Remote Desktop Protocol (used in |
|---|
| 276 | // Windows Terminal Services) |
|---|
| 277 | { |
|---|
| 278 | "replaytv-ivs", "l7"}, // ReplayTV Internet Video Sharing - Digital |
|---|
| 279 | // Video Recorder - http://replaytv.com |
|---|
| 280 | { |
|---|
| 281 | "rlogin", "l7"}, // rlogin - remote login - RFC 1282 |
|---|
| 282 | { |
|---|
| 283 | "rpm", "l7"}, // RPM - Redhat Package Management packages |
|---|
| 284 | { |
|---|
| 285 | "rtf", "l7"}, // RTF - Rich Text Format - an open document |
|---|
| 286 | // format |
|---|
| 287 | { |
|---|
| 288 | "rtp", "l7"}, // RTP - Real-time Transport Protocol - RFC |
|---|
| 289 | // 3550 |
|---|
| 290 | { |
|---|
| 291 | "rtsp", "l7"}, // RTSP - Real Time Streaming Protocol - |
|---|
| 292 | // http://www.rtsp.org - RFC 2326 |
|---|
| 293 | { |
|---|
| 294 | "runesofmagic", "l7"}, |
|---|
| 295 | { |
|---|
| 296 | "shoutcast", "l7"}, // Shoutcast and Icecast - streaming audio |
|---|
| 297 | { |
|---|
| 298 | "sip", "l7"}, // SIP - Session Initiation Protocol - |
|---|
| 299 | // Internet telephony - RFC 3261 |
|---|
| 300 | { |
|---|
| 301 | "skypeout", "l7"}, // Skype to phone - UDP voice call (program |
|---|
| 302 | // to POTS phone) - http://skype.com |
|---|
| 303 | { |
|---|
| 304 | "skypetoskype", "l7"}, // Skype to Skype - UDP voice call (program |
|---|
| 305 | // to program) - http://skype.com |
|---|
| 306 | { |
|---|
| 307 | "smb", "l7"}, // Samba/SMB - Server Message Block - |
|---|
| 308 | // Microsoft Windows filesharing |
|---|
| 309 | { |
|---|
| 310 | "smtp", "l7"}, // SMTP - Simple Mail Transfer Protocol - RFC |
|---|
| 311 | // 2821 (See also RFC 1869) |
|---|
| 312 | { |
|---|
| 313 | "snmp", "l7"}, // SNMP - Simple Network Management Protocol |
|---|
| 314 | // - RFC 1157 |
|---|
| 315 | { |
|---|
| 316 | "snmp-mon", "l7"}, // SNMP Monitoring - Simple Network |
|---|
| 317 | // Management Protocol (RFC1157) |
|---|
| 318 | { |
|---|
| 319 | "snmp-trap", "l7"}, // SNMP Traps - Simple Network Management |
|---|
| 320 | // Protocol (RFC1157) |
|---|
| 321 | { |
|---|
| 322 | "socks", "l7"}, // SOCKS Version 5 - Firewall traversal |
|---|
| 323 | // protocol - RFC 1928 |
|---|
| 324 | { |
|---|
| 325 | "soribada", "l7"}, // Soribada - A Korean P2P filesharing |
|---|
| 326 | // program/protocol - |
|---|
| 327 | // http://www.soribada.com |
|---|
| 328 | { |
|---|
| 329 | "soulseek", "p2p"}, // Soulseek - P2P filesharing - |
|---|
| 330 | // http://slsknet.org |
|---|
| 331 | { |
|---|
| 332 | "ssdp", "l7"}, // SSDP - Simple Service Discovery Protocol - |
|---|
| 333 | // easy discovery of network devices |
|---|
| 334 | { |
|---|
| 335 | "ssh", "l7"}, // SSH - Secure SHell |
|---|
| 336 | { |
|---|
| 337 | "ssl", "l7"}, // SSL and TLS - Secure Socket Layer / |
|---|
| 338 | // Transport Layer Security - RFC 2246 |
|---|
| 339 | { |
|---|
| 340 | "stun", "l7"}, // STUN - Simple Traversal of UDP Through NAT |
|---|
| 341 | // - RFC 3489 |
|---|
| 342 | { |
|---|
| 343 | "subspace", "l7"}, // Subspace - 2D asteroids-style space game - |
|---|
| 344 | // http://sscentral.com |
|---|
| 345 | { |
|---|
| 346 | "subversion", "l7"}, // Subversion - a version control system |
|---|
| 347 | { |
|---|
| 348 | "tar", "l7"}, // Tar - tape archive. Standard UNIX file |
|---|
| 349 | // archiver, not just for tapes. |
|---|
| 350 | { |
|---|
| 351 | "teamfortress2", "l7"}, // Team Fortress 2 - network game - |
|---|
| 352 | // http://www.valvesoftware.com |
|---|
| 353 | { |
|---|
| 354 | "teamspeak", "l7"}, // TeamSpeak - VoIP application - |
|---|
| 355 | // http://goteamspeak.com |
|---|
| 356 | { |
|---|
| 357 | "telnet", "l7"}, // Telnet - Insecure remote login - RFC 854 |
|---|
| 358 | { |
|---|
| 359 | "tesla", "l7"}, // Tesla Advanced Communication - P2P |
|---|
| 360 | // filesharing (?) |
|---|
| 361 | { |
|---|
| 362 | "tftp", "l7"}, // TFTP - Trivial File Transfer Protocol - |
|---|
| 363 | // used for bootstrapping - RFC 1350 |
|---|
| 364 | { |
|---|
| 365 | "thecircle", "l7"}, // The Circle - P2P application - |
|---|
| 366 | // http://thecircle.org.au |
|---|
| 367 | {"tonghuashun", "l7"}, |
|---|
| 368 | |
|---|
| 369 | { |
|---|
| 370 | "tor", "l7"}, // Tor - The Onion Router - used for |
|---|
| 371 | // anonymization - http://tor.eff.org |
|---|
| 372 | { |
|---|
| 373 | "tsp", "l7"}, // TSP - Berkely UNIX Time Synchronization |
|---|
| 374 | // Protocol |
|---|
| 375 | { |
|---|
| 376 | "unknown", "l7"}, // - |
|---|
| 377 | { |
|---|
| 378 | "uucp", "l7"}, // UUCP - Unix to Unix Copy |
|---|
| 379 | { |
|---|
| 380 | "validcertssl", "l7"}, // Valid certificate SSL |
|---|
| 381 | { |
|---|
| 382 | "ventrilo", "l7"}, // Ventrilo - VoIP - http://ventrilo.com |
|---|
| 383 | { |
|---|
| 384 | "vnc", "l7"}, // VNC - Virtual Network Computing. Also |
|---|
| 385 | // known as RFB - Remote Frame Buffer |
|---|
| 386 | { |
|---|
| 387 | "whois", "l7"}, // Whois - query/response system, usually |
|---|
| 388 | // used for domain name info - RFC 3912 |
|---|
| 389 | { |
|---|
| 390 | "winmx", "p2p"}, // Whois - query/response system, usually |
|---|
| 391 | |
|---|
| 392 | { |
|---|
| 393 | "worldofwarcraft", "l7"}, // World of Warcraft - popular network game - |
|---|
| 394 | // http://blizzard.com/ |
|---|
| 395 | { |
|---|
| 396 | "x11", "l7"}, // X Windows Version 11 - Networked GUI |
|---|
| 397 | // system used in most Unices |
|---|
| 398 | { |
|---|
| 399 | "xboxlive", "l7"}, // XBox Live - Console gaming |
|---|
| 400 | { |
|---|
| 401 | "xdcc", "p2p"}, // XBox Live - Console gaming |
|---|
| 402 | { |
|---|
| 403 | "xunlei", "l7"}, // Xunlei - Chinese P2P filesharing - |
|---|
| 404 | // http://xunlei.com |
|---|
| 405 | { |
|---|
| 406 | "yahoo", "l7"}, // Yahoo messenger - an instant messenger |
|---|
| 407 | // protocol - http://yahoo.com |
|---|
| 408 | { |
|---|
| 409 | "zip", "l7"}, // ZIP - (PK|Win)Zip archive format |
|---|
| 410 | { |
|---|
| 411 | "zmaap", "l7"}, // ZMAAP - Zeroconf Multicast Address |
|---|
| 412 | // Allocation Protocol |
|---|
| 413 | { |
|---|
| 414 | 0, 0} |
|---|
| 415 | }; |
|---|
