text: /* Copyright 2021 AOL Inc. All rights reserved.
   *
   * Licensed under the Apache License, Version 2.0 (the "License");
   * you may not use this Software except in compliance with the License.
   * You may obtain a copy of the License at
   *
   *     http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  #include "moloch.h"
  
  /******************************************************************************/
  LOCAL void rpc_classify_udp(MolochSession_t *session, const unsigned char *data, int len, int UNUSED(which), void *UNUSED(uw))
  {
      if (len < 16)
          return;
  
      char *name = 0;
  
      switch (data[15]) {
      case 0xa0:
          name = "portmap";
          break;
      case 0xa1:
          name = "rstat";
          break;
      case 0xa2:
          name = "rusers";
          break;
      case 0xa4:
          name = "ypprog";
          break;
      case 0xa5:
          name = "mount";
          break;
      case 0xa7:
          name = "ypbind";
          break;
      case 0xa8:
          name = "wall";
          break;
      case 0xa9:
          name = "yppasswd";
          break;
      case 0xab:
          name = "rquota";
          break;
      case 0xb1:
          name = "rexec";
          break;
      case 0xc5:
          name = "tfs";
          break;
      default:
          return;
      }
  
      if (moloch_session_has_protocol(session, name))
          return;
      moloch_session_add_protocol(session, name);
  }
  /******************************************************************************/
  void moloch_parser_init()
  {
      moloch_parsers_classifier_register_udp("rpc", NULL, 4, (unsigned char *)"\x00\x00\x00\x00\x00\x00\x00\x02\x00\x01\x86", 11, rpc_classify_udp);
  }
  
  