cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2663
Views
0
Helpful
4
Replies

IPS Regex for Boolean "AND"

ganesh.kumar
Level 1
Level 1

Hi,

anyone know the regex string for Boolean "AND" operator. I came to know OR operator got string "|". But unable to find string for AND operator.

any help would be appreciated.

1 Accepted Solution

Accepted Solutions

Hi Ganesh,

Say, in your example, if the strings Color and Green are separated by AAAA, you can write a regex as "ColorAAAAGreen".

If you are not sure what characters can be between Color and Green, you can have a regex like "Color[\x00-\xff]*Green". This will fire if you see Color followed by Green in the traffic stream. But this includes a wildcard and could be memory-intensive. multistring engine would be better in this case.

So depending on the traffic you are matching, you can hardcode some strings in the regex and get the AND functionality.

HTH,

Radhika

View solution in original post

4 Replies 4

a.matahen
Level 1
Level 1

Hello Ganesh,

Are you trying to configure more than one action for a signature?

You can do that using the same operator, but with no spaces, the command should be:

event-action produce-alert|deny-packet-inline

make sure that you write "deny-packet-inline" not any abbriviation like deny-p

HTH

Ahmad

Hi,

i am looking a option to use Regex. For example color and Green. I know multi-string can do this. But looking option to use in same line like we use OR (I) operator in Regex.

Hi Ganesh,

Say, in your example, if the strings Color and Green are separated by AAAA, you can write a regex as "ColorAAAAGreen".

If you are not sure what characters can be between Color and Green, you can have a regex like "Color[\x00-\xff]*Green". This will fire if you see Color followed by Green in the traffic stream. But this includes a wildcard and could be memory-intensive. multistring engine would be better in this case.

So depending on the traffic you are matching, you can hardcode some strings in the regex and get the AND functionality.

HTH,

Radhika

Hi Rupadras,

Thanks for the reply. Your answer worked me perfectly.

Review Cisco Networking for a $25 gift card