Regarding #2, That's most likely what it is. This is a stream based signature, so the regex doesn't have to fall inside one particular packet, it has to be in the stream of reassembled packets. Turning on the signature action "Produce Verbose Alert" will give you more context, and you may be able to catch the end colon.
Regarding #1, Really there's no difference between ":" or "[:]" (minus the quotes) in a regex. The brackets denote a character class so [abc] means one of either a or b or c. In the case of [:] it's a character class with only one character. There is a reason that you see one value character classes in our signatures, and it simply comes down to readability... it's easy to miss something like a single colon wedged in amongst a large regex, it's not so easy to miss it when we stick it into a character class.
BenefitsDocumentationPrerequisiteImage Download LinksLimitationsSupported PlatformsLicense RequirementsTopologyStep-By-Step ConfigurationConfigure Virtual ServiceActivate the virtual service and configure guest IPsConfiguring UTD (Service Plane)Configurin...
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...