#
# Rules that classify hosts by service. These are applied to every 'a' SAINT
# record. Basically, they translate the cryptic SAINT record data to something
# that is more suitable for reports.
#
# Format of this file is:
#
#	class_name
#	condition TABs service_name TABS host
#
# The class_name is SERVERS or CLIENTS.
# 
# The condition is a PERL expression, with full access to the global
# $target..$text variables.
#
# The service_name field specifies a name such as "anonymous FTP" or
# "NFS (diskless)".
#
# The host field specifies the host that takes or provides the service.
# When no host is specified, $target is assumed.
#
# Empty lines and text after a "#" character are ignored. Long lines may
# be broken with backslash-newline.
#

SERVERS

$service eq "nntp"			NNTP (Usenet news)
$service eq "ftp"			FTP
$service eq "finger"			Finger
/offers login / || $service eq "shell" || $service eq "exec"	R Series
$service =~ /pop-[23]/			POP
/offers anon ftp/			FTP (with anonymous)
/offers ftp/ && /:/			FTP
/220.*ftp server/i && $service ne "ftp" && $service =~ /([^:]+)/	FTP (non-standard port $1)
/offers snmp/				SNMP
/SSH/					SSH
/offers ssh/				SSH
/NIS server/				NIS
/runs NFS| exports \S+ to /		NFS
/mounts \S+ from (\S+)/			NFS	$1
/offers domain/				DNS
/\/root\/\S+ to \S+/			NFS (diskless)
/offers gopher/				Gopher
/offers imap/				IMAP	
$service eq "telnet" && /:/		Telnet
/offers telnet/				Telnet
$service eq "netbios-ssn" && /Netbios/	SMB
/offers netbios/			SMB
$service eq "smtp"			SMTP
$service eq "http"			WWW
/offers https/ && /(?!<)/		WWW (Secure)
/offers X-[0-9]+$/			X Windows
$service eq "xdmcp"			XDM (X login)
/telnet on port (\d+)/			Telnet on port $1
/<title>/i && $service ne "http" && !/Server: SAINT/ && $service =~ /([^:]+)/	WWW (non-standard port $1)
/HTTP\/\d/i && $service ne "http" && !/Server: SAINT/ && $service =~ /([^:]+)/	WWW (non-standard port $1)
/<title>/i && /Server: SAINT/		SAINT
/0'QUIT'/ && $service ne "gopher" && $service =~ /([^:]+)/	Gopher (non-standard port $1)

OTHER_SERVERS

NONE OF THE ABOVE && /offers (\S+) \((\d+):(\w+)\)/	$1 ($2/$3)
NONE OF THE ABOVE && /offers (\d+):(\w+)/	$1/$2

CLIENTS

/NIS client/				NIS
/\/root\/\S+ to (\S+)/			NFS (diskless)		$1
/exports \S+ to \(\S+\)/		NFS			$1
/([^| ]+) mounts \S+ from \S+/		NFS			$1
