RegExpr Condition

The RegExpr condition applies a regular expression to certain data. It uses the properties ApplyTo, Offset, Length, UseDataAvail and IfNull to determine what data will be subject to the regular expression test and what the return value will be if the data isn't available. Also see section “Specifying Data for Conditions”.

Data Attribute

Type Binary Data
Default (empty)
Description The Data attribute specifies the regular expression to be applied to the data referenced by ApplyTo, Offset and Length.

ExpectMatch Attribute

Type Distinct Values
Default Any
Description

Specifies the regular expression must match the complete data or if any substring matching the regular expression is sufficient.

Allowed values are:
  • Any: Matching any substring is sufficient.
  • Complete: Complete data must match the regular expression.

GenVerify Attribute

This attribute is only applicable if the condition is used within a TcpRuleRecvProto rule. See section "GenVerify Attribute Of Conditions" for details.

Example

<RegExpr>
  <ApplyTo>Http.Response.Body</ApplyTo>
  <Data>&lt;html&gt;.*&lt/html&gt;</Data>
</RegExpr>
Parent topic: Conditions