Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual page 28

Regular Expression Syntax
Table 1-2
Character
()
[]
\
The following examples demonstrate the special characters:
•
a*
•
a+
•
ba?b
•
\**
To use multipliers with multiple-character patterns, you enclose the pattern in parentheses.
•
(ab)*
•
([A-Za-z][0-9])+
empty string is not a match).
The order for matches using multipliers (*, +, or ?) is to put the longest construct first. Nested constructs
are matched from outside to inside. Concatenated constructs are matched beginning at the left side of the
construct. Thus, the regular expression matches A9b3, but not 9Ab3 because the letters are specified
before the numbers.
You can also use parentheses around a single- or multiple-character pattern to instruct the software to
remember a pattern for use elsewhere in the regular expression.
To create a regular expression that recalls a previous pattern, you use parentheses to indicate memory of
a specific pattern and a backslash (\) followed by a digit to reuse the remembered pattern. The digit
specifies the occurrence of a parentheses in the regular expression pattern. If you have more than one
remembered pattern in your regular expression, then \1 indicates the first remembered pattern, and \2
indicates the second remembered pattern, and so on.
The following regular expression uses parentheses for recall:
a(.)bc(.)\1\2 matches an a followed by any character, followed by bc followed by any character,
•
followed by the first any character again, followed by the second any character again.
For example, the regular expression can match aZbcTZT. The software remembers that the first
character is Z and the second character is T and then uses Z and T again later in the regular
expression.
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
1-8
Regular Expression Syntax (continued)
Description
Affects the order of pattern evaluation and also serves as a tagged expression that can
be used when replacing the matched sub-string with another expression.
Enclosing a set of characters indicates that any of the enclosed characters may match
the target character.
Allows specifying a character that would otherwise be interpreted as special.
\xHH represents the character whose value is the same as the value represented by
(HH) hexadecimal digits [0-9A-Fa-f]. The value must be non-zero.
BEL is the same as \x07, BS is \x08, FF is \x0C, LF is \x0A, CR is \x0D, TAB is \x09,
and VT is \x0B.
For any other character 'c', '\c' is the same as 'c' except that it is never interpreted as
special
matches any number of occurrences of the letter a, including none.
requires that at least one letter a be in the string to be matched.
matches the string bb or bab.
matches any number of asterisks (*).
matches any number of the multiple-character string ab.
matches one or more instances of alphanumeric pairs, but not none (that is, an
Chapter 1 Introducing the CLI Configuration Guide
78-16527-01