Hi Brandon Both works. My understanding is that "specify request regex" checks the regex in the http header and the payload.
But if I put "cmd.exe" in the "specify header regex", it doesn't work. Any idea, why it is not working. URI is present in the HTTP header right? With regards Kings On Wed, Apr 14, 2010 at 11:50 AM, Brandon Carroll <[email protected]>wrote: > Kings: > > Note below that request-regex also includes the HTTP URI portion and > arguments field. Ultimately I think either one will match. I also recall > something about the RFC defining the URI to include the http:// portion. > IOS considers the URL to be after the first / so that may have something to > do with it. Try both. Do they both work? If so, it probably doesn't > matter which one you chose. Remember that the DSG is just one interpretation > of how they task can be solved. As long as you dont break the requirements > to meet the task I think you're fine. > > > specify-request-regex > > (Optional) Enables searching the Request field for a specific regular > expression: > > •request-regex—Regular expression to search in both HTTP URI and HTTP > Argument fields. > > •specify-min-request-match-length—Enables setting a minimum request match > length. > > > specify-uri-regex > > (Optional) Regular expression to search in HTTP URI field. The URI field is > defined to be after the HTTP method (GET, for example) and before the first > CRLF. The regular expression is protected, which means you cannot change the > value. > > [/\\][a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z][.]jpeg > > > > Regards, > > Brandon Carroll - CCIE #23837 > Senior Technical Instructor - IPexpert > Mailto: [email protected] > Telephone: +1.810.326.1444 > Live Assistance, Please visit: www.ipexpert.com/chat > eFax: +1.810.454.0130 > > IPexpert is a premier provider of Self-Study Workbooks, Video on Demand, > Audio Tools, Online Hardware Rental and Classroom Training for the Cisco > CCIE (R&S, Voice, Security & Service Provider) certification(s) with > training locations throughout the United States, Europe, South Asia and > Australia. Be sure to visit our online communities at > www.ipexpert.com/communities and our public website at www.ipexpert.com > > > > On Apr 13, 2010, at 11:01 PM, Kingsley Charles wrote: > > typo > > On Wed, Apr 14, 2010 at 11:31 AM, Kingsley Charles < > [email protected]> wrote: > >> Waiting for your inputs. >> >> Vol 2 > Lab 17 > Section 3.3. >> >> Matching of keyword "running-config". >> >> The solution is using "Specify Request regex". >> >> Please let me know, why we have used "Specify Request regex". >> >> Specify URI regex is the best choice, right? >> >> Any specific reason for using "Specify Request regex". >> >> >> >> With regards >> Kings >> On Tue, Apr 13, 2010 at 10:25 PM, Kingsley Charles < >> [email protected]> wrote: >> >>> Hi all >>> >>> In the service http engine, you have following option: >>> >>> 1) Specify URI regex >>> 2) Specify Header regex >>> 3) Specify Request regex >>> >>> >>> *Query 1* >>> ** >>> Let's consider a task to match "cmd.exe" anywhere in the http url. >>> >>> If I use option 1 and 2 with "cmd.exe", the sig triggers. But with option >>> 2, the sig doesn't trigger. I thought, option 2 will also trigger as URI is >>> also part of http header. >>> >>> >>> *Query 2* >>> >>> Will "Specify Request regex" match the regex both in the the header and >>> payload? >>> >>> >>> >>> With regards >>> Kings >>> >> >> > _______________________________________________ > For more information regarding industry leading CCIE Lab training, please > visit www.ipexpert.com > > >
<<blank.gif>>
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
