Page 1 of 1

Any one konws how to mark http protocol?

Posted: Mon May 04, 2015 12:51 pm
by kensoual
As we all know that HTTP use tcp port 80,BUT,some download tools or IM use 80 too,

so,is there any way to recognise HTTP or even HTTPS very well?

I don't kown L7 very much,really bother... :(

TKS :D

Re: Any one konws how to mark http protocol?

Posted: Tue May 05, 2015 9:26 pm
by Feklar
http://l7-filter.sourceforge.net/protocols
/ip firewall layer7-protocol
add name=HTTPS regexp="^(.\?.\?\\x16\\x03.*\\x16\\x03|.\?.\?\\x01\\x03\\x01\?.*\\x0b)"