def guess_protocol_from_payload(cls, payload, config, addr):
"""
Iterates through known protocols to see if the payload is recognized
:param payload: raw payload received from a connection
:return: Protocol object
"""
identified_protocol = cls
for protocol in cls.get_known_protocols(config):
log.debug("Checking for {}".format(protocol))
protocol_class = core.find_protocol_class(protocol)
new_protocol = protocol_class.guess_protocol_from_payload(payload, config, addr)
if new_protocol != identified_protocol:
identified_protocol = new_protocol
break
return identified_protocol
def guess_protocol_from_payload(cls, payload, config, addr):
"""
Iterates through known protocols to see if the payload is recognized
:param payload: raw payload received from a connection
:return: Protocol object
"""
identified_protocol = HTTP
if payload and payload.startswith(
b"POST ") and b"\r\nUser-Agent: Mozilla/4.0":
identified_protocol = Andromeda
for protocol in cls.get_known_protocols(config):
log.debug("Checking for {}".format(protocol))
protocol_class = core.find_protocol_class(protocol)
new_protocol = protocol_class.guess_protocol_from_payload(
payload, config, addr)
if new_protocol != identified_protocol:
identified_protocol = protocol_class
break
return identified_protocol
def guess_protocol_from_payload(cls, payload, config, addr):
"""
Iterates through known protocols to see if the payload is recognized
:param payload: raw payload received from a connection
:return: Protocol object
"""
identified_protocol = tcp.TCP
if payload and cls.http_regex.match(
payload.decode('utf-8', errors="ignore")):
identified_protocol = HTTP
for protocol in cls.get_known_protocols(config):
log.debug("Checking for {}".format(protocol))
protocol_class = core.find_protocol_class(protocol)
new_protocol = protocol_class.guess_protocol_from_payload(
payload, config, addr)
log.debug(new_protocol)
if new_protocol != identified_protocol:
log.debug("New sub-protocol detected: {}".format(
new_protocol.name))
identified_protocol = new_protocol
break
return identified_protocol
def guess_protocol(self, first_payload, config, addr=None):
proto_class = core.find_protocol_class(self.protocol)
return proto_class.guess_protocol_from_payload(first_payload, config,
addr)