pattern

Use the pattern keyword is specify which content to match. The pattern can contain mixed text and binary data. The binary data is generally enclosed with the pipe "|" characters, and is represented as hexadecimal numbers. It can match content in all packets for all protocols.

You must enclose the pattern to be matched in double quotation marks and follow it with a semicolon. The special characters (" ; \ | :) must be written as (|22|, |3B| or |3b|, |5C| or |5c|, |7C| or |7c|, |3A|| or |3a|). You can use backslash (\) to escape any character except a semicolon (;). However, using hexadecimal representation for |5C| for backslash is recommended as a good practice..

Syntax:

--pattern [!]"<text>";

[!] indicates the content is matched if it does not appear in the packet.

Examples:

--pattern "/level";

--pattern"|E8 D9FF FFFF|/bin/sh";

--pattern !"|20|RTSP/";