Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started.

New Member

IPS 5.X Regex String With Space?

If I want to match a string for the following, what should my regex value be? Would it accept a space?

user 1 1

-or-

get setup_

I'm trying to find documentation that tells me how to use a space in the regex.

Thanks in advance

  • Intrusion Prevention Systems/IDS
6 REPLIES
Gold

Re: IPS 5.X Regex String With Space?

Have you tried pressing the spacebar;-)

[Uu][Ss][Ee][Rr] 1 1

Another trick, one that Cisco often uses, is to enclose the space in brackets like so:

"[Uu][Ss][Ee][Rr][ ]1[ ]1"

It shouldn't make a difference in terms of matching, but it makes the regex more readable.

Cisco Employee

Re: IPS 5.X Regex String With Space?

We will actually stay away from a space inside brackets and use the hex representation \x20. It comes down to readability for us - a single space or a double space inside brackets looks very similar, but you can't mistake the hex:

[Uu][Ss][Ee][Rr]\x20[1]\x20[1]

Gold

Re: IPS 5.X Regex String With Space?

That's a good point. Is that a new standard because there are lots of sigs with a [ ] in the regex.?

New Member

Re: IPS 5.X Regex String With Space?

So you're saying that it will accept just a plain space?

For example, if I wanted it to hit on lowercase only the following would work?

get setup_

Gold

Re: IPS 5.X Regex String With Space?

yes

Cisco Employee

Re: IPS 5.X Regex String With Space?

I don't know if I'd go call it a standard. We (meaning the sig team) tend to use the hex value (\x20) because it's a clearly definitive "thing" to represent one space, and one space only. We do it simply because there's no mistaking exactly what it is.

143
Views
0
Helpful
6
Replies