---------------------------------------------------------------------	
(a)
---------------------------------------------------------------------	

signature wizard-1 {
   ip-proto == tcp
   dst-port == 6667 # That's as close as we get to saying "IRC please"
   payload /.*wizard.*/
   event "Found a Wizard 1!"
}

signature wizard-2 {
   ip-proto == tcp
   src-port == 6667 # That's as close as we get to saying "IRC please"
   payload /.*wizard.*/
   event "Found a Wizard 2!"
}

---------------------------------------------------------------------	
(b)
---------------------------------------------------------------------	

@load irc
	
redef IRC::hot_words += /.*wizard.*/;

@load tcp
@load irc

---------------------------------------------------------------------	
(c)
---------------------------------------------------------------------	
    
module Wizard;

export  {
	# Define a NOTICE type for our alert. 
	redef enum Notice += {
		WizardFound
	};

	# The nick name we are looking for.
	const wizards_nick = "wizard" &redef;
}

function check_for_wizard(c: connection, user: string, channel: string)
	{
	if ( user in wizards_nick )
		NOTICE([$note=WizardFound, $conn=c, 
				$msg=fmt("found Wizard on channel %s", channel)]);
	}

event irc_names_info(c: connection, c_type: string, channel: string, users: string_set)
	{
	for ( user in users )
		check_for_wizard(c, user, channel);
	}

event irc_join_message(c: connection, info_list: irc_join_list)
	{
	for ( info in info_list )
		check_for_wizard(c, info$nick, info$channel);
	}