Regarding pattern matching in bro
Vern Paxson
vern at icir.org
Thu Mar 21 23:44:57 PST 2002
> Is it possible to do a pattern matching using bro scripts
> for a hex pattern.
> for eg:
> "90 31 C0 99 52 52 B017 CD80 68 CC 73 68"
> or it supports only pattern matching for strings.
What do you mean by a "hex pattern"? You can search for 8-bit regular
expressions, e.g. /\x90\x31\xc0\x99/. Bro's regular expressions operate
on strings, but strings can contain arbitrary binary data.
Vern
More information about the Bro
mailing list