pattern

Use the pattern keyword is specify which content to match. The pattern can contain mixed text and binary data. The binary data is generally enclosed with the pipe "|" characters, and is represent as hexadecimal numbers. It can match content in all packets for all protocols.

You must enclose the pattern to be matched in double quotation marks and follow it with a semicolon. The special characters (" ; \ | :) must be written as (|22|, |3B| or |3b|, |5C| or |5c|, |7C| or |7c|, |3A|| or |3a|). You can use backslash (\) to escape any character except a semicolon (;), however, we do not recommend using it.

Syntax:

--pattern [!]"<text>";

[!] indicates the content is matched if it does not appear in the packet.

Examples:

--pattern "/level";

--pattern"|E8 D9FF FFFF|/bin/sh";

--pattern !"|20|RTSP/";