Regexp for L7 protocols

Hi all!

Recently I tested regexps for l7 protocols and found:

  • if I’m entering regexp=“get” then I have all http GET-request matching with this filter
  • if I’m entering hexademical values of GET (regexp=“\x47\x45\x54”) I have nothing o_O

Why?

Thanks for help!

Thats because its \x47\x45\x54

My notation is for ssh session :slight_smile:
The first slash is the escape symbol :wink:

Up!