/etc/l7-protocols/protocols/qq.pat is in l7-protocols 20090528-4.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | # Tencent QQ Protocol - Chinese instant messenger protocol - http://www.qq.com
# Pattern attributes: good notsofast fast
# Protocol groups: chat
# Wiki: http://www.protocolinfo.org/wiki/QQ
# Copyright (C) 2008 Matthew Strait, Ethan Sommer; See ../LICENSE
#
# Over six million people use QQ in China, according to wsgtrsys.
#
# This pattern has been tested and is believed to work well.
#
# QQ uses three (two?) methods to connect to server(s?).
# one is udp, and another is tcp
# udp protocol: the first byte is 02 and last byte is 03
# tcp protocol: the second byte is 02 and last byte is 03
# tony on protocolinfo.org says that now the *third* byte is 02:
# "but when I tested on my PC, I found that when qq2007/qq2008
# use tcp protocol, the third byte instead of the second is always 02.
#
# So the QQ protocol changed again, or I have made a mistake, I wonder
# that."
# So now the pattern allows any of the first three bytes to be 02. Delete
# one of the ".?" to restore to the old behaviour.
# pattern written by www.routerclub.com wsgtrsys
qq
^.?.?\x02.+\x03$
|