Kings:Note below that request-regex also includes the HTTP URI portion and arguments field. Ultimately I think either one will match. I also recall something about the RFC defining the URI to include the http:// portion. IOS considers the URL to be after the first / so that may have something to do with it. Try both. Do they both work? If so, it probably doesn't matter which one you chose. Remember that the DSG is just one interpretation of how they task can be solved. As long as you dont break the requirements to meet the task I think you're fine.
specify-request-regex | (Optional) Enables searching the Request field for a specific regular _expression_: • request-regex—Regular _expression_ to search in both HTTP URI and HTTP Argument fields. •specify-min-request-match-length—Enables setting a minimum request match length. |
specify-uri-regex | (Optional) Regular _expression_ to search in HTTP URI field. The URI field is defined to be after the HTTP method (GET, for example) and before the first CRLF. The regular _expression_ is protected, which means you cannot change the value. | [/\\][a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z][.]jpeg |
Regards,
Brandon Carroll - CCIE #23837 Senior Technical Instructor - IPexpert Telephone: +1.810.326.1444 eFax: +1.810.454.0130
IPexpert is a premier provider of Self-Study Workbooks, Video on Demand, Audio Tools, Online Hardware Rental and Classroom Training for the Cisco CCIE (R&S, Voice, Security & Service Provider) certification(s) with training locations throughout the United States, Europe, South Asia and Australia. Be sure to visit our online communities at www.ipexpert.com/communities and our public website at www.ipexpert.com
On Apr 13, 2010, at 11:01 PM, Kingsley Charles wrote: typo
On Wed, Apr 14, 2010 at 11:31 AM, Kingsley Charles <[email protected]> wrote:
Waiting for your inputs.
Vol 2 > Lab 17 > Section 3.3.
Matching of keyword "running-config".
The solution is using "Specify Request regex".
Please let me know, why we have used "Specify Request regex".
Specify URI regex is the best choice, right?
Any specific reason for using "Specify Request regex".
With regards
Kings
On Tue, Apr 13, 2010 at 10:25 PM, Kingsley Charles <[email protected]> wrote:
Hi all
In the service http engine, you have following option:
1) Specify URI regex
2) Specify Header regex
3) Specify Request regex
Query 1
Let's consider a task to match "cmd.exe" anywhere in the http url.
If I use option 1 and 2 with "cmd.exe", the sig triggers. But with option 2, the sig doesn't trigger. I thought, option 2 will also trigger as URI is also part of http header.
Query 2
Will "Specify Request regex" match the regex both in the the header and payload?
With regards
Kings
_______________________________________________
For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
|
_______________________________________________
For more information regarding industry leading CCIE Lab training, please visit
www.ipexpert.com
