Template Lookup

The following parameter allows to specify a template against which the IPS will scan the packet payload:

.pattern[!]="string";

Note Note that the search is case sensitive.

HEX data should be specified using "|" symbol, for example: |05 00 27|.

To specify special symbols, use the notations provided in the following table:

Symbol

HEX notation

"

|22|.

;

|3B| or |3b|.

\

|5C| or |5c|.

|

|7C| or |7c|.

:

|3A| or |3a|.

In addition to the = operator, the != operator can also be used. If the latter operator is specified, it will search for packets which do not contain a specified template.

The parameter has the following general format:

.pattern[!]="string"; [.where=<MODE>;] [.no_case;] [.distance=<RANGE>[,<MODE>];] [.within=<RANGE>[,<MODE>];] [.service=<MODE>;]

Search area modifiers (.where, .no_case, .distance, .within, .service) will be detailed later.

When writing a signature a number of .pattern parameters can be used to reduce the number of false positives.