[Bro] Using a 'OR' condition in Signature payloads

Vern Paxson vern at icir.org
Mon Oct 30 19:08:37 PST 2006

> 	payload /.*(abc) | (xyz).*/
> ...
> Is there anything wrong in writing the 'OR' condition?

Yes, this should be written instead as:

	payload /.*(abc)|(xyz).*/

Or, if you want to match "abc" or "xyz" anywhere in the payload, as:

	payload /.*(abc|xyz).*/

- Vern

More information about the Bro mailing list