Cisco PIX 500 Series Configuration Manual page 395

Chapter 21 Using Modular Policy Framework
Use Ctrl+V to escape all of the special characters in the CLI, such as question mark (?) or a tab. For
example, type d[Ctrl+V]g to enter d?g in the configuration.
See the regex command in the Cisco Security Appliance Command Reference for performance impact
information when matching a regular expression to packets.
As an optimization, the security appliance searches on the deobfuscated URL. Deobfuscation
Note
compresses multiple forward slashes (/) into a single slash. For strings that commonly use double
slashes, like "http://", be sure to search for "http:/" instead.
Table 21-1
Table 21-1
Character Description
.
(exp)
|
?
*
+
{x} or {x,} Minimum repeat quantifier
[abc]
[^abc]
OL-12172-03
lists the metacharacters that have special meanings.
regex Metacharacters
Dot
Subexpression
Alternation
Question mark
Asterisk
Plus
Character class
Negated character class
Configuring Special Actions for Application Inspections
Notes
Matches any single character. For example, d.g matches
dog, dag, dtg, and any word that contains those
characters, such as doggonnit.
A subexpression segregates characters from surrounding
characters, so that you can use other metacharacters on
the subexpression. For example, d(o|a)g matches dog
and dag, but do|ag matches do and ag. A subexpression
can also be used with repeat quantifiers to differentiate
the characters meant for repetition. For example,
ab(xy){3}z matches abxyxyxyz.
Matches either expression it separates. For example,
dog|cat matches dog or cat.
A quantifier that indicates that there are 0 or 1 of the
previous expression. For example, lo?se matches lse or
lose.
You must enter Ctrl+V and then the question
Note
mark or else the help function is invoked.
A quantifier that indicates that there are 0, 1 or any
number of the previous expression. For example, lo*se
matches lse, lose, loose, and so on.
A quantifier that indicates that there is at least 1 of the
previous expression. For example, lo+se matches lose
and loose, but not lse.
Repeat at least x times. For example, ab(xy){2,}z
matches abxyxyz, abxyxyxyz, and so on.
Matches any character in the brackets. For example,
[abc] matches a, b, or c.
Matches a single character that is not contained within
the brackets. For example, [^abc] matches any character
other than a, b, or c. [^A-Z] matches any single
character that is not an uppercase letter.
Cisco Security Appliance Command Line Configuration Guide
21-7