/etc/l7-protocols/protocols/radmin.pat is in l7-protocols 20090528-4.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | # Famatech Remote Administrator - remote desktop for MS Windows
# Pattern attributes: ok veryfast fast
# Protocol groups: remote_access proprietary
# Wiki: http://www.protocolinfo.org/wiki/Radmin
# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE
#
# This pattern has been verified with Radmin v1.1 and v3.0beta on Win2000/XP
# It has only been tested between a single pair of computers.
# The first packet of every TCP stream appears to be either one of:
#
# 01 00 00 00 01 00 00 00 08 08
# 01 00 00 00 01 00 00 00 1b 1b
radmin
^\x01\x01(\x08\x08|\x1b\x1b)$
|