Cisco Systems IPS4510K9 manual AIC Engine, Nnn, To Match Regular Expression

Appendix B Signature Engines

AIC Engine

Table B-3	Signature Regular Expression Syntax (continued)
Metacharacter		Name	Description
[^abc]		Negated character class	Any character not listed.
[a-z]		Character range class	Any character listed inclusively in the range.
( )		Parenthesis	Used to limit the scope of other metacharacters.
		Alternation, or	Matches either expression it separates.
^		caret	The beginning of the line.
\char		Escaped character	When char is a metacharacter or not, matches the literal
			char.
char		Character	When char is not a metacharacter, matches the literal
			char.
\r		Carriage return	Matches the carriage return character (0x0D).
\n		New line	Matches the new line character (0x0A).
\t		Tab	Matches the tab character (0x09).
\f		Form feed	Matches the form feed character (0x0C).
\xNN		Escaped hexadecimal	Matches character with the hexadecimal code 0xNN
		character	(0<=N<=F).
\NNN		Escaped octal character	Matches the character with the octal code NNN
			(0<=N<=8).

All repetition operators will match the shortest possible string as opposed to other operators that consume as much of the string as possible thus giving the longest string match.

Table B-4lists examples of Regex patterns.

Table B-4	Regex Patterns
To Match		Regular Expression
Hacker		Hacker
Hacker or hacker		[Hh]acker
Variations of bananas, banananas, banananananas		ba(na)+s
foo and bar on the same line with anything except a new line between them		foo.*bar
Either foo or bar		foobar
Either moon or soon		(ms)oon

AIC Engine

The Application Inspection and Control (AIC) engine inspects HTTP web traffic and enforces FTP commands. This section describes the AIC engine and its parameters, and contains the following topics:

•Understanding the AIC Engine, page B-11

•AIC Engine and Sensor Performance, page B-11

•AIC Engine Parameters, page B-11

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
B-10	OL-29168-01