B-10
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixB Signature Engines
AIC Engine
All repetition operators will match the shortest possible string as opposed to other operators that
consume as much of the string as possible thus giving the longest string match.
Tabl e B-4 lists examples of Regex patterns.
AIC Engine
The Application Inspection and Control (AIC) engine inspects HTTP web traffic and enforces FTP
commands. This section describes the AIC engine and its parameters, and contains the following topics:
•
Understanding the AIC Engine, page B-11
•
AIC Engine and Sensor Performance, page B-11
•
AIC Engine Parameters, page B-11
[^abc] Negated character class Any character not listed.
[a-z] Character range class Any character listed inclusively in the range.
( ) Parenthesis Used to limit the scope of other metacharacters.
| Alternation, or Matches either expression it separates.
^ caret The beginning of the line.
\char Escaped character When char is a metacharacter or not, matches the literal
char.
char Character When char is not a metacharacter, matches the literal
char.
\r Carriag e return Matches the carriage return character (0x0D).
\n New line Matches the new line character (0x0A).
\t Tab Matches the tab character (0x09).
\f Form feed Matches the fo rm feed character (0x0C).
\xNN Escaped hexadecimal
character
Matches character with the hexadecimal cod e 0xNN
(0<=N<=F).
\NNN Escaped octal character Matches the character with the octal code NNN
(0<=N<=8).
TableB-3 Signature Regular Expression Syntax (continued)
Metacharacter Name Description
TableB-4 Regex Patterns
To Match Regular Expression
Hacker Hacker
Hacker or hacker [Hh]acker
Variations of bananas, banananas, banananananas ba(na)+s
foo and bar on the same line with anything except a new line between them foo.*bar
Either foo or bar foo|bar
Either moon or soon (m|s)oon