Is it bug on NBAR

MACattackMACattack Member Posts: 121
Hi,

I found this info in other site and tested in my lab but seems are not working well

Match protocol HTTP host

The match protocol HTTP url command is used to match a url. It takes a regular expression as an argument. For example:

match protocol http host *youtube.com*
! This would match anything in youtube.com like http://www.youtube.com or http://video.youtube.com
!
match protocol http host *google*
! This would match anything with google in the host like http://mail.google.com or
http://www.google.com.au
!
match protocol http host google*
! This would match http://google.com but not http://video.google.com

The 1st match protocol http host *youtube* works for me
but youtube* did not work but if I entered http://youtube.com then a match is found same with google*

################################################

Now here's I am getting trouble

Match protocol HTTP url

We can match strings AFTER the host portion of a URL using the match protocol http url command. It also takes a regular expression as an argument. For example:

match protocol http url *video*
! This would match http://www.cisco.com/video/index.php or
http://www.google.com/stuff/video.html
!
match protocol http url video*
! This would match http://www.cisco.com/video but not http://www.cisco.com/stuff/video.html
! because stuff precedes the video portion of the url and in the expression above we have said
! it has to start with the string video
!>>this one does not work for me

but when using *video* on match protocol http url *video* then match found but not match protocol http url video*

match protocol http url *.jpeg|*.jpg|*.gif
! This would match any .jpeg or .jpg or .gif extention in the url

I tried this but seems not working well

according to the above if I used video* it will match let say www.cisco.com/video

but this one is not working..

It is clear what is the use of * to match any criteria but I am wondring why it does not taking.


IS THIS A BUG or AM I WRONG?
Sign In or Register to comment.