From d47615139a4acb88f584f17aa83f6c705dc04884 Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Thu, 20 Oct 2016 15:01:06 +0000
Subject: [PATCH] Add iperf3 probe and match line. Closes #416

---
 CHANGELOG           | 2 ++
 nmap-service-probes | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index b75144014..0ab0dc5b9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,7 @@
 # Nmap Changelog ($Id$); -*-text-*-
 
+o [GH#416] New service probe and match line for iperf3. [Eric Gershman]
+
 o [NSE][GH#555] Add Drupal to the set of web apps brute forced by
   http-form-brute. [Nima Ghotbi]
 
diff --git a/nmap-service-probes b/nmap-service-probes
index d7efbd2b1..6abbfa876 100644
--- a/nmap-service-probes
+++ b/nmap-service-probes
@@ -15064,3 +15064,11 @@ ports 443,4433,4740,5349,5684,6514,6636,10161,10162
 # OpenSSL 1.1.0 s_server -dtls -listen
 # HelloVerifyRequest always uses DTLS 1.1 version, per RFC 6347
 match dtls m|^\x16\xfe\xff\0\0\0\0\0\0\0\0..\x03...\0\0\0\0\0...\xfe\xff.|
+
+##############################NEXT PROBE##############################
+# Detects iperf3 servers by sending a string longer than the 37-byte test identifer or cookie
+# https://github.com/esnet/iperf/wiki/IperfProtocolStates#test-initiation
+Probe TCP iperf3 q|0000000000000000000000000000000000000\0\0\0\0|
+ports 5201
+rarity 9
+match iperf3 m|^\t$|