From 52e3939e854bec115a50e1bbc1d4f963db56ce0c Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Thu, 9 Jan 2020 17:59:16 +0000
Subject: [PATCH] New UDP payload for Beckhoff TwinCAT ADS, prevents DoS

Closes #1862. Note that the service name will be added to our
comprehensive services database and will appear when nmap-services is
next generated from that source.
---
 nmap-payloads | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nmap-payloads b/nmap-payloads
index 3e0c7f3c8..8bf9c7502 100644
--- a/nmap-payloads
+++ b/nmap-payloads
@@ -322,3 +322,8 @@ udp 9987
 # https://github.com/memcached/memcached/blob/master/doc/protocol.txt
 udp 11211
 "\0\x01\0\0\0\x01\0\0version\r\n"
+
+# Beckhoff ADS discovery request
+# https://github.com/ONE75/adsclient/blob/master/src/AdsClient.Finder/DeviceFinder.cs#L49-L64
+udp 48899
+"\x03\x66\x14\x71\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x01\x10\x27\x00\x00\x00\x00"