topic Re: Regex Issue in Custom Signatures

Regex Issue

dkramer — Wed, 25 Apr 2018 14:12:12 GMT

Hey Everyone,

I am having an issue that I can't explain. I am building a signature to match on IP addresses in the X-Forwarded-For Http header. what I have come up with is this: "For: 1\.2\.[3-4]\..*" This is working well, but I am having an issue with certain ranges I have one that is "For: x\.x\.[176-179]\..*" this throws an invalid pattern error and I have it narrowed down to the actual range of 176-179. If I switch that to be [170-179] it accepts the pattern fine. Has anyone seen this issue before? If so how did you fix it?

Thanks,

Dave

Re: Regex Issue

JoeAndreini — Wed, 02 May 2018 17:26:29 GMT

the [] operators do not work the way you think in regex.

[170-179] means "1, or 7, or a number between 0 and 1 inclusive, or 7 or 9"

therefore, [176-179] means "1, or 7, or a number between 6 and 1 inclusive (this is invalid), or 7, or 9

put another way, the [] operators mean "one of these characters"

to match numbers between 176 and 179, inclusive you should have "17[6-9]"

Re: Regex Issue

dkramer — Wed, 02 May 2018 18:41:11 GMT

Thank you for the answer. I figured it out just this morning as well. There is another option which is to use hex in place of the integers so that 176-179 becomes [\xB0-B3\x]