Merge pull request #2724 in SNORT/snort3 from ~AGIURGIU/snort3:pcapng_pattern to...

Squashed commit of the following:

commit 79691dc526824df6b74f77c777572f6810058c74
Author: Alexandru Giurgiu <agiurgiu@cisco.com>
Date:   Thu Jan 28 13:10:29 2021 +0200

    file_magic: New pattern for pcapng

diff --git a/lua/file_magic.lua b/lua/file_magic.lua
index 4160c2ef9442d632e01288241dfda001b2db3dc7..e828f7942d4c406454d36973ab10f58e0ee08294 100644 (file)
--- a/lua/file_magic.lua
+++ b/lua/file_magic.lua
@@ -131,6 +131,7 @@ file_magic =
     { type = 'PCAP', id = 145, category = 'System files', msg = 'Packet capture file', rev = 1, magic = { { content = '|A1 B2 C3 D4 |', offset = 0, }, }, },
     { type = 'PCAP', id = 146, category = 'System files', msg = 'Packet capture file', rev = 1, magic = { { content = '|A1 B2 CD 34 |', offset = 0, }, }, },
     { type = 'PCAP', id = 147, category = 'System files', msg = 'Packet capture file', rev = 1, magic = { { content = '|52 54 53 53 |', offset = 0, }, }, },
+    { type = 'PCAP', id = 325, category = 'System files', msg = 'Packet capture file', rev = 1, magic = { { content = '| 0A 0D 0D 0A |', offset = 0, }, }, },
     { type = 'BMP', id = 148, category = 'Graphics', msg = 'Bitmap image file', rev = 1, group = 'multimedia', magic = { { content = '|42  4D |', offset = 0, }, }, },
     { type = 'ICO', id = 149, category = 'Graphics', msg = 'Windows icon file', rev = 1, magic = { { content = '| 00 00 01 00 |', offset = 0, }, }, },
     { type = 'TORRENT', id = 150, category = 'Executables', msg = 'BitTorrent File', rev = 1, magic = { { content = '| 64 38 3A 61 6E 6E 6F 75 6E 63 65  |', offset = 0, }, }, },