topic Re: pattern match for less than 7 byte application in Custom Signatures

pattern match for less than 7 byte application

sayed_shubbar — Thu, 15 Aug 2019 20:32:23 GMT

Hello all,

we are trying to implement user-Agent feature that's exist in MWG proxy. on attched wireshark capture screen shot "wget" user agent has only 4 bytes. do you have work around to make signature equal to 7 bytes.

I also attached screen shot erro from Palo

Re: pattern match for less than 7 byte application

S.Cantwell — Wed, 21 Aug 2019 21:15:00 GMT

It would be something like this:

User-Agent: Wget/[0-9]\.[0-20]\.[0-9]

I am not sure how many versions of Wget there are.

User-Agent: Wget/1.13.4 may be the only one you need.

If you have higher versions, use the RegEx listed at the beginning of my message.

Re: pattern match for less than 7 byte application

sayed_shubbar — Thu, 22 Aug 2019 20:42:07 GMT

I got attached error message. I do not think palo allow backets

Re: pattern match for less than 7 byte application

S.Cantwell — Thu, 22 Aug 2019 21:51:23 GMT

Brackets are allowed. We just did not have the 7 bytes yet.

I just created this one on my FW

User-Agent: Wget/[0-9]\.[0-20]\.[0-9]

Give a go and let me know.