1-9
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter1 Introducing the CLI Configuration Guide
Regular Expression Syntax
The following examples demonstrate the special characters:
•a*
matches any number of occurrences of the letter a, including none.
•a+
requires that at least one letter a be in the string to be matched.
•ba?b
matches the string bb or bab.
•\**
matches any number of asterisks (*).
To use multipliers with multiple-character patterns, you enclose the pattern in parentheses.
•(ab)*
matches any number of the multiple-character string ab.
•([A-Za-z][0-9])+
matches one or more instances of alphanumeric pairs, but not none (that is, an
empty string is not a match).
The order for matches using multipliers (*, +, or ?) is to put the longest construct first. Nested constructs
are matched from outside to inside. Concatenated constructs are matched beginning at the left side of the
construct. Thus, the regular expression matches A9b3, but not 9Ab3 because the letters are specified
before the numbers.
You can also use parentheses around a single- or multiple-character pattern to instruct the software to
remember a pattern for use elsewhere in the regular expression.
$ Matches the end of the string. The expression “abc$” matches the sub-string “abc”
only if it is at the end of the string.
| Allows the expression on either side to match the target string. The expression “a |b”
matches “a” as well as “b.”
. Matches any character.
* Indicates that the character to the left of the asterisk in the expression should match 0
or more times.
+ Similar to * but there should be at least one match of the character to the left of the +
sign in the expression.
? Matches the character to its left 0 or 1 times.
() Affects the order of pattern evaluation and also serves as a tagged expression that can
be used when replacing the matched sub-string with another expression.
[] Enclosing a set of characters indicates that any of the enclosed characters may match
the target character.
\ Allows specifying a character that would otherwise be interpreted as special.
\xHH represents the character whose value is th e same as the value represented by
(HH) hexadecimal digits [0-9A-Fa-f]. The value must be non-zero.
BEL is the same as \x07, BS is \x08, FF is \x0C, LF is \x0A, CR is \x0D, TAB is \x09,
and VT is \x0B.
For any other character ‘c’, ‘\c’ is the same as ‘c’ except that it is never interpreted as
special
Table1-2 Regular Expression Syntax (continued)
Character Description