Table of Contents
Advertisement
Appendix A
Intrusion Detection System Architecture
•
•
•
•
The following string matches any number of asterisks (*):
\**
To use multipliers with multiple-character patterns, you enclose the pattern in
parentheses. In the following example, the pattern matches any number of the
multiple-character string ab:
(ab)*
The following pattern matches one or more instances of alphanumeric pairs, but
not none (that is, an empty string is not a match):
([A-Za-z][0-9])+
The order for matches using multipliers (*, +, or ?) is to put the longest construct
first. Nested constructs are matched from outside to inside. Concatenated
constructs are matched beginning at the left side of the construct. Thus, the
regular expression matches A9b3, but not 9Ab3 because the letters are specified
before the numbers.
Cisco Intrusion Detection System Appliance and Module Installation and Configuration Guide Version 4.1
78-15597-02
The following pattern requires that at least one letter a be in the string to be
matched:
a+
?—The question mark (?) matches the character to its left 0 or 1 times.
The following pattern matches the string bb or bab:
ba?b
()—The parenthesis affects the order of pattern evaluation and also serves as
a tagged expression that can be used when replacing the matched substring
with another expression.
[]—Brackets ([ and ]) enclosing a set of characters indicates that any the
enclosed characters can match the target character.
\—The escape character specifies a character that would otherwise be
interpreted as special. \xHH represents the character whose value is the same
as the value represented by (HH) hexadecimal digits [0-9A-Fa-f]. The value
must be non-zero. BEL is the same as \x07, BS is \x08, FF is \x0C, LF is \x0A,
CR is \x0D, TAB is \x09, and VT is \x0B. For any other character 'c', '\c' is
the same a 'c.'
System Components
A-35
Advertisement
Table of Contents
Troubleshooting
