 | 1 | initial version |
From the 6.4.2. Comparing Values:
6.4.2.3. Possible Pitfalls Using Regular Expressions
Alternatively, a raw string syntax can be used. Such strings are prefixed with r or R and treat backslash as a literal character.
Using raw strings avoids most problem with the "matches" operator and double escape requirements.
CHARACTER TYPES
. any character except newline; in dotall mode, any character whatsoever
OPTION SETTING
Changes of these options within a group are automatically cancelled at the end of the group.
...
(?s) single line (dotall)
Combining the information above into a filter:
data.data matches r"(?s)\xcc\xcc.{6,6}\x37\x11.*\x24\x02"
| | 2 | No.2 Revision |
From the WSUG 6.4.2. Comparing Values:
6.4.2.3. Possible Pitfalls Using Regular Expressions
Alternatively, a raw string syntax can be used. Such strings are prefixed with r or R and treat backslash as a literal character.
Using raw strings avoids most problem with the "matches" operator and double escape requirements.
CHARACTER TYPES
. any character except newline; in dotall mode, any character whatsoever
OPTION SETTING
Changes of these options within a group are automatically cancelled at the end of the group.
...
(?s) single line (dotall)
Combining the information above into a filter:
data.data matches r"(?s)\xcc\xcc.{6,6}\x37\x11.*\x24\x02"
| | 3 | No.3 Revision |
From the WSUG 6.4.2. Comparing Values:
6.4.2.3. Possible Pitfalls Using Regular Expressions
Alternatively, a raw string syntax can be used. Such strings are prefixed with r or R and treat backslash as a literal character.
Using raw strings avoids most problem with the "matches" operator and double escape requirements.
CHARACTER TYPES
. any character except newline; in dotall mode, any character whatsoever
OPTION SETTING
Changes of these options within a group are automatically cancelled at the end of the group.
...
(?s) single line (dotall)
Combining the information above into a filter:
data.data matches r"(?s)\xcc\xcc.{6,6}\x37\x11.*\x24\x02"
It's possible to do some regex testing in Edit -> Find Packet...:
