Creating spacers in regex match

ahuang14 has asked for the wisdom of the Perl Monks concerning the following question:

Hey guys,

This might be a very easy thing to do but I just don't know how. I want to be able to match both these strings (using Snort to get packets that contain these expressions)

...16 03 01 34 23 0b.... ...16 03 01 39 4b 0b....

I was wondering if there was a way to write a match expression like "m/16 03 01 anything anything 0b/".

I guess a work around could be to look for the index of "16 03 01" and then say check to see if 6 characters away is "0b," but I was just wondering if there was a better way of doing this. Thanks in advance!

Comment on Creating spacers in regex match

Replies are listed 'Best First'.
Re: Creating spacers in regex match by JavaFan (Canon) on Jul 08, 2011 at 15:10 UTC
Well, "anything" in a regexp is written as `(?s:.)`, but it seems you want to match two two-hexit hex numbers. Which means you could write: `/16 03 01 [[:xdigit:]]{2} [[:xdigit:]]{2} 0b/` [download]	[reply] [d/l] [select]
Re^2: Creating spacers in regex match by ahuang14 (Novice) on Jul 08, 2011 at 15:18 UTC
ah I got you. can you just explain what the xdigit means? I'm new to perl and I want to learn. How is this different than the ?s:.	[reply]
Re^3: Creating spacers in regex match by JavaFan (Canon) on Jul 08, 2011 at 15:24 UTC
`[[:xdigit:]]` is a character class that matches a hex digit. See `man perlrecharclass`. `(?s:.)` matches any single character; `(?s:.*)` matches any possible string of characters.	[reply] [d/l] [select]
Re^4: Creating spacers in regex match by ahuang14 (Novice) on Jul 08, 2011 at 19:21 UTC
Re^5: Creating spacers in regex match by JavaFan (Canon) on Jul 08, 2011 at 21:12 UTC
Re: Creating spacers in regex match by Jim (Curate) on Jul 08, 2011 at 19:39 UTC
Use alternation to match the exact two substrings you intend to match. `m/\b16 03 01 (?:34 23\|39 4b) 0b\b/` [download] This regular expression pattern will only match the two substrings... 16 03 01 34 23 0b 16 03 01 39 4b 0b The word boundary assertion `\b` ensures you won't wrongly match a substring like 916 03 01 34 23 0bf. Jim	[reply] [d/l] [select]
Re^2: Creating spacers in regex match by muba (Priest) on Jul 09, 2011 at 02:32 UTC
Alternation sounds good, but only if just `34 23` or `39 4b` are accepted. From what I gather from the OP, any two pairs of hexadecimal digits could get there. Alternation really isn't the means to the desired end here.	[reply] [d/l] [select]
Re^3: Creating spacers in regex match by Jim (Curate) on Jul 09, 2011 at 05:25 UTC
Alternation sounds good, but only if just 34 23 or 39 4b are accepted. From what I gather from the OP, any two pairs of hexadecimal digits could get there. Alternation really isn't the means to the desired end here. You misread what the OP wrote. Only 34 23 and 39 4b are acceptable. I want to be able to match both these strings ...16 03 01 34 23 0b.... ...16 03 01 39 4b 0b.... Alternation is what's needed here. Jim	[reply]
Re^4: Creating spacers in regex match by muba (Priest) on Jul 09, 2011 at 08:13 UTC

16 03 01 34 23 0b 16 03 01 39 4b 0b