/etc/l7-protocols/protocols/citrix.pat is in l7-protocols 20090528-4.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 | # Citrix ICA - proprietary remote desktop application - http://citrix.com
# Pattern attributes: marginal notsofast notsofast
# Protocol groups: remote_access proprietary
# Wiki: http://www.protocolinfo.org/wiki/Citrix
# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE
#
# This pattern is UNTESTED.
# This is based on decode_citrix in dsniff 2.4.
citrix
\x32\x26\x85\x92\x58
|