Regarding pattern matching in bro

Vern Paxson vern at icir.org
Thu Mar 21 23:44:57 PST 2002


> Is it possible to do a pattern matching using bro scripts
> for a hex pattern.
> for eg:
> "90 31 C0 99 52 52 B017 CD80 68 CC 73 68"
> or it supports only pattern matching for strings.

What do you mean by a "hex pattern"?  You can search for 8-bit regular
expressions, e.g. /\x90\x31\xc0\x99/.  Bro's regular expressions operate
on strings, but strings can contain arbitrary binary data.

		Vern



More information about the Bro mailing list