>Может .*Adobe\.Flash\.Proxy\.Auto-Discovery.* :) :(( тож не работает ....
там в примерах следующие реализации регэкспов:
bittorrent:
^(\x13bittorrent protocol|azver\x01$|get /scrape\?info_hash=)|d1:ad2:id20:|\x08'7P\)[RP]
dhcp:
^[\x01\x02][\x01- ]\x06.*c\x82sc
# (\x01|\x02) is for BOOTREQUEST or BOOTREPLY
# Is there a demand for doing these seperately? The Packeteer does.
#
# [\x01-\x20] is for any of the hardware address types listed at
# (http://www.iana.org/assignments/arp-parameters) and hopefully faster
# ethernets too (100, 1000 and 10000mb) as well (do they share the 10mb
# number?).
#
# \x06 for "hardware address length = 6 bytes". Does anyone use other lengths
# these days? If so, this pattern won't match it as it stands.
dns:
^.?.?.?.?[\x01\x02].?.?.?.?.?.?[\x01-?][a-z0-9][\x01-?a-z]*[\x02-\x06][a-z][a-z][fglmoprstuvz]?[aeop]?(um)?[\x01-\x10\x1c][\x
01\x03\x04\xFF]
ftp:
# by default, we allow only ASCII
^220[\x09-\x0d -~]*ftp
# This covers UTF-8 as well
#^220[\x09-\x0d -~\x80-\xfd]*ftp
# This allows any characters and is about 4x faster than either of the above
# (which are about the same as each other)
#^220.*ftp
# This is much slower
#^220[\x09-\x0d -~]*ftp|331[\x09-\x0d -~]*password
# This pattern is more precise, but takes longer to match. (3 packets vs. 1)
#^220[\x09-\x0d -~]*\x0d\x0aUSER[\x09-\x0d -~]*\x0d\x0a331
# same as above, but slightly less precise and only takes 2 packets.
#^220[\x09-\x0d -~]*\x0d\x0aUSER[\x09-\x0d -~]*\x0d\x0a
http://l7-filter.sourceforge.net/
Вариант для распечатки
Программирование под UNIX (Public)
(ok) on 15-Дек-07, 03:04 
