+++ /dev/null
-# NCP - Novell Core Protocol
-# Pattern quality: good veryfast
-# Protocol groups: networking
-#
-# This pattern has been tested and is believed to work well.
-#
-# To get or provide more information about this protocol and/or pattern:
-# http://www.protocolinfo.org/wiki/NCP
-# http://lists.sourceforge.net/lists/listinfo/l7-filter-developers
-
-# ncp request
-# dmdt means Request
-# *any length
-#
-# *any reply buffer size
-# "" means service request
-# | \x17\x17 means create a service connection
-# | uu means destroy service connection
-
-# ncp reply
-# tncp means reply
-# 33 means service reply
-
-ncp
-^(dmdt.*\x01.*(""|\x11\x11|uu)|tncp.*33)