H3C Technologies H3C Intelligent Management Center - Manual (Page 44)

34
5. Click OK to confirm the deletion of the selected application.
The Application List reflects the deletion of the selected application.
Regular expressions in NTA
If you selected Layer 7 from the Application Type list to add an application, you must enter a regular
expression string in the Regular Expression field that NTA uses to identify the application in the Layer 7
portion of each IP packet examined.
A regular expression contains 1 to 255 characters in hexadecimal notation or in text string. The
hexadecimal notation contains \x01 through \xff. The text string can contain letters, digits, and symbols
(also known as metacharacters).
Metacharacters in regular expressions
• Brackets ([])—Matches a single character contained within the brackets. For example, [abc]
matches a, b, or c.
• Vertical bar (|)—Matches either the expression before or the expression after the operator. For
example, ab | cd matches ab or cd.
• Parentheses (())—Defines a subexpression. For example, a(b|c)d matches abd or acd, but not ab,
cd, or abcd.
• Dot (.)—Matches any single character. For example, a.b matches avb, but not ab or avwb.
Contained within a bracket expression, this character matches a literal dot.
• Asterisk (*)—Matches the preceding element zero or more times. For example, a*bc matches bc,
abc, aabc, and so on. Contained within a bracket expression, this character matches a literal
asterisk.
• Plus sign (+)—Matches the preceding element one or more times. For example, a+bc matches abc,
aabc, aaabc, and so on. Contained within a bracket expression, this character matches a literal
plus sign.
• Question mark (?)—Matches the preceding element zero or one time. For example, a?bc only
matches bc or abc. Contained within a bracket expression, this character matches a literal question
mark.
• Caret (^)—Matches the beginning of a string. For example, ^the matches the string "the man is tall",
but not "is the man tall". A bracket expression containing this character ([^]) matches a single
character that is not contained within the brackets. For example, [^abc] matches abcd or ef, but not
ac or bc.
• Dollar sign ($)—Matches the end of a string. For example, man$ matches the string "abnormal
man", but not "the man is tall".
• Minus sign (-)—Represents a range if it is not the first or last character within the brackets. For
example, [a-c] matches any lower-case character from a to c (that is, a, b, or c). Being the first or last
character in a bracket expression, this character matches a literal minus sign.
• Example 1
Regular expression ^\x13BitTorrent protocol matches the content of a BitTorrent handshake
packet, which starts with hexadecimal character \x13 and is followed by the string "BitTorrent
protocol". The regular expression would match "\x13BitTorrent protocol 1.22v", but not
"BitTorrent protocol 1.22v" or "our protocol is \x13BitTorrent protocol", which do not start with
\x13.
• Example 2