IPS 5.X Regex String With Space?

[paulhignutt]

If I want to match a string for the following, what should my regex value be? Would it accept a space?

user 1 1

-or-

get setup_

I'm trying to find documentation that tells me how to use a space in the regex.

Thanks in advance

[mhellman]

Have you tried pressing the spacebar;-)

[Uu][Ss][Ee][Rr] 1 1

Another trick, one that Cisco often uses, is to enclose the space in brackets like so:

"[Uu][Ss][Ee][Rr][ ]1[ ]1"

It shouldn't make a difference in terms of matching, but it makes the regex more readable.

[wsulym]

We will actually stay away from a space inside brackets and use the hex representation \x20. It comes down to readability for us - a single space or a double space inside brackets looks very similar, but you can't mistake the hex:

[Uu][Ss][Ee][Rr]\x20[1]\x20[1]

[mhellman]

That's a good point. Is that a new standard because there are lots of sigs with a [ ] in the regex.?

[paulhignutt]

So you're saying that it will accept just a plain space?

For example, if I wanted it to hit on lowercase only the following would work?

get setup_

[mhellman]

yes

[wsulym]

I don't know if I'd go call it a standard. We (meaning the sig team) tend to use the hex value (\x20) because it's a clearly definitive "thing" to represent one space, and one space only. We do it simply because there's no mistaking exactly what it is.