cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
455
Views
0
Helpful
6
Replies

IPS 5.X Regex String With Space?

paulhignutt
Level 1
Level 1

If I want to match a string for the following, what should my regex value be? Would it accept a space?

user 1 1

-or-

get setup_

I'm trying to find documentation that tells me how to use a space in the regex.

Thanks in advance

6 Replies 6

mhellman
Level 7
Level 7

Have you tried pressing the spacebar;-)

[Uu][Ss][Ee][Rr] 1 1

Another trick, one that Cisco often uses, is to enclose the space in brackets like so:

"[Uu][Ss][Ee][Rr][ ]1[ ]1"

It shouldn't make a difference in terms of matching, but it makes the regex more readable.

We will actually stay away from a space inside brackets and use the hex representation \x20. It comes down to readability for us - a single space or a double space inside brackets looks very similar, but you can't mistake the hex:

[Uu][Ss][Ee][Rr]\x20[1]\x20[1]

That's a good point. Is that a new standard because there are lots of sigs with a [ ] in the regex.?

So you're saying that it will accept just a plain space?

For example, if I wanted it to hit on lowercase only the following would work?

get setup_

yes

I don't know if I'd go call it a standard. We (meaning the sig team) tend to use the hex value (\x20) because it's a clearly definitive "thing" to represent one space, and one space only. We do it simply because there's no mistaking exactly what it is.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: