[ https://bro-tracker.atlassian.net/browse/BIT-1497?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=22646#comment-22646 ]
Robin Sommer commented on BIT-1497: ----------------------------------- Ah, I see the problem: you need to write it like this: {noformat} /[[:space:]]/ {noformat} (i.e., double brackets). These work only inside a character class (which I believe is standard behavior). > pattern [:space:] shortcut not matching as expected > --------------------------------------------------- > > Key: BIT-1497 > URL: https://bro-tracker.atlassian.net/browse/BIT-1497 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.4 > Environment: Running tests using Bro 2.4.1 (precompiled from > http://download.opensuse.org/repositories/network:/bro/xUbuntu_14.10/) on > Ubuntu 14.10. > Running using a simple "/opt/bro/bin/bro myscript.bro" syntax. > Reporter: Lloyd Brown > Labels: pattern > Attachments: patterns.space_shortcut.testcase.bro, > patterns.space_shortcut.testcase.bro.output > > > I'm trying to do some RegEx-like pattern matching of a data stream using Bro, > and I'm finding that, at least some of the shortcuts, like '[:space:]' don't > seem to act as expected. > In short, I expected that '[:space:]' and '[ \f\n\r\t\v]' would be > interchangeable, but that doesn't seem to be the case. I have not tested any > other shortcuts like '[:alpha:]', '[:digit:]', etc. Just '[:space:]' so far. > I will attach an example script, as well as a file containing the output I'm > seeing. -- This message was sent by Atlassian JIRA (v7.0.0-OD-08-002#70107) _______________________________________________ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev