Wireshark-users: Re: [Wireshark-users] Display filter

From: Hank Leininger <hlein@xxxxxxxxxxxxx>
Date: Thu, 3 May 2007 23:35:15 -0400

On Fri, May 04, 2007 at 01:33:22AM +0200, Luis Ontanon wrote:
> On 5/4/07, Irakli Natshvlishvili <iraklin@xxxxxxxxx> wrote:
> 
> > Also, could you clarify what type of regex wireshark supports?
> pcre
> 
> > Here is the example - if there is a one line string:
> >
> >  sip:@10.10.10.20
> sip matches "sip:[ ]+@xxxxxxxxxxx"
> 
> > What would be regex which will find all packets matching "sip:" followed by
> > "@" when there are zero or more whitespace chars between "sip:" and "@"?

Actually, for zero or more, you want *, not + (which is "one or more"):

  sip matches "sip:[ ]*@10.10.10.20"

> > I want to find out if a regex when  a string1 is followed by 0 or more (1 or
> > more, exactly nn times, more then n, but less then m) whilespace (or
> > alphanumerical or CLRF) characters before string2 can be written for
> > wireshark. Above example is one of such case, my previous question, about
> > CLRF was another.

  string1[\r\n\sa-zA-Z0-9]{0,30}string2

Adjust what's in the [ ]'s for whatever characters you want to accept in
the intervening space.  Curly braces say how many such tokens:

	{n,m}	At least n times, at most m times.
	{n,}	At least n times, no upper limit.
	{n}	Exactly n times
	{,m}	Nonsense (invalid)

Some suggested readings:

- man perlre, or Google, and search for "The following standard
  quantifiers are recognized"
- Mastering Regular Expressions, by Jeffrey Friedl.  Will hurt your head
  and teach you more than you ever wanted to know about RE's.

Thanks,

Hank

Attachment: pgpkmb31njZgN.pgp
Description: PGP signature