Environment - DEBIAN 4.0
Protocol definitions: 2008-11-08
l7-filter kernel version: 2.20
DB server : FirebirdSS-188.8.131.522-0
I'm not at all familiar with Interbase. Can you suggest any way to distinguish between it and QQ? The QQ pattern is, generally, pretty hard to match on randomly (about 0.04% of random connections), but it's certainly possible that Interbase coincidentally uses the same bytes in the same places.