topic Re: IPS 5.X Regex String With Space? in Network Security

IPS 5.X Regex String With Space?

NotMeHere — Sun, 10 Mar 2019 10:11:44 GMT

If I want to match a string for the following, what should my regex value be? Would it accept a space?

user 1 1

-or-

get setup_

I'm trying to find documentation that tells me how to use a space in the regex.

Thanks in advance

Re: IPS 5.X Regex String With Space?

mhellman — Wed, 30 Aug 2006 16:29:04 GMT

Have you tried pressing the spacebar;-)

[Uu][Ss][Ee][Rr] 1 1

Another trick, one that Cisco often uses, is to enclose the space in brackets like so:

"[Uu][Ss][Ee][Rr][ ]1[ ]1"

It shouldn't make a difference in terms of matching, but it makes the regex more readable.

Re: IPS 5.X Regex String With Space?

wsulym — Wed, 30 Aug 2006 20:06:35 GMT

We will actually stay away from a space inside brackets and use the hex representation \x20. It comes down to readability for us - a single space or a double space inside brackets looks very similar, but you can't mistake the hex:

[Uu][Ss][Ee][Rr]\x20[1]\x20[1]

Re: IPS 5.X Regex String With Space?

mhellman — Wed, 30 Aug 2006 21:19:39 GMT

That's a good point. Is that a new standard because there are lots of sigs with a [ ] in the regex.?

Re: IPS 5.X Regex String With Space?

NotMeHere — Wed, 30 Aug 2006 21:25:03 GMT

So you're saying that it will accept just a plain space?

For example, if I wanted it to hit on lowercase only the following would work?

get setup_

Re: IPS 5.X Regex String With Space?

mhellman — Thu, 31 Aug 2006 11:29:50 GMT

yes

Re: IPS 5.X Regex String With Space?

wsulym — Thu, 31 Aug 2006 12:02:45 GMT

I don't know if I'd go call it a standard. We (meaning the sig team) tend to use the hex value (\x20) because it's a clearly definitive "thing" to represent one space, and one space only. We do it simply because there's no mistaking exactly what it is.