On Fri, May 04, 2007 at 01:33:22AM +0200, Luis Ontanon wrote: > On 5/4/07, Irakli Natshvlishvili <[EMAIL PROTECTED]> wrote: > > > Also, could you clarify what type of regex wireshark supports? > pcre > > > Here is the example - if there is a one line string: > > > > sip:@10.10.10.20 > sip matches "sip:[ [EMAIL PROTECTED]" > > > What would be regex which will find all packets matching "sip:" followed by > > "@" when there are zero or more whitespace chars between "sip:" and "@"?
Actually, for zero or more, you want *, not + (which is "one or more"):
sip matches "sip:[ [EMAIL PROTECTED]"
> > I want to find out if a regex when a string1 is followed by 0 or more (1 or
> > more, exactly nn times, more then n, but less then m) whilespace (or
> > alphanumerical or CLRF) characters before string2 can be written for
> > wireshark. Above example is one of such case, my previous question, about
> > CLRF was another.
string1[\r\n\sa-zA-Z0-9]{0,30}string2
Adjust what's in the [ ]'s for whatever characters you want to accept in
the intervening space. Curly braces say how many such tokens:
{n,m} At least n times, at most m times.
{n,} At least n times, no upper limit.
{n} Exactly n times
{,m} Nonsense (invalid)
Some suggested readings:
- man perlre, or Google, and search for "The following standard
quantifiers are recognized"
- Mastering Regular Expressions, by Jeffrey Friedl. Will hurt your head
and teach you more than you ever wanted to know about RE's.
Thanks,
Hank
pgpuLYB1gEvrv.pgp
Description: PGP signature
_______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
