l7 and strange results using mikrotik script

RouterOS General
1

Using this script in MK ros 3.16 http://www.mikrotik.com/download/l7-protos.rsc
i have got different results from that, that are on official layer7 siter

e.g ares:
result in mk after script:

^[]Z].?.?$

on official site:

^\x03[]Z].?.?\x05$

what is now right and how it supposed to be to work right?


PS:
When I used original pattern for bittorent:

^(\x13bittorrent protocol|azver\x01$|get /scrape\?info_hash=get /announce\?info_hash=|get /client/bitcomet/|GET /data\?fid=)|d1:ad2:id20:|\x08'7P\)[RP]

downloaded from:
http://l7-filter.sourceforge.net/layer7-protocols/protocols/bittorrent.pat

it marked also normal http connection on port 80 browsing(I found it out: I marked packets with rule with l7 bittorrent in mangle, then drop this packet mark in /firewall/filter and I couldnt browse web sites, only after disabling).

Could somebody explain me this?

2 
^[]Z].?.?$

and

^\x03[]Z].?.?\x05$

are the same patterns.

  1. L7 are not 100% accurate. Similar patterns can be found in different protocols. In your case HTTP was marked as bittorent because l7 matcher found pattern similar to bittorents.