NodesNodes
This topic defines language for the flex parser nodes.
Nodes Language DefinitionNodes Language Definition
| Node Name | Attribute Name | Description |
|---|---|---|
| parsers | The root node in each definition file. | |
| xmins:xsi | Defines the namespace to use for the schema inclusion. This attribute is not required; however, language definition is not possible without it. This node must have the following value: http://www.w3.org/2001/XMLSchema-instance | |
| xsi:noNamespaceSchemaLocation | Defines the XSD schema validation file used to validate the language definition. This attribute is not required; however, language definition is not possible without it. This node must have the following value: parsers.xsd | |
| parser | The node that defines a single parser definition. This node must be directly under the parsers node. There can be more than one per file. | |
| name | The name that uniquely identifies the parser. This name should be short and succinct. This is used by the system to allow enabling and disabling. It should contain only the letters [a-z] and [A-Z]. | |
| desc | Provides a friendly description of what the parser does. | |
| service | The unique number assigned to the session when identified. | |
| declaration | Delineates the definition. Each of these definitions can have an associated match entry. | |
| token | Specifies a definition for identifying a token somewhere in the session protocol. This defines a match callback when the specified tokens are encountered in a session payload. The read position is set to the byte immediately following the matched token. | |
| name | This is a unique identifier for the declaration. | |
| value | This is the exact token value to be identified. | |
| options | Options specify that the token should start on a new line or at an end of a line (linestart or linestop). | |
| meta-callback | Registers a callback for the flex parser whenever meta of a specific format is created. This can be further qualified to generate callbacks only for sessions that have been identified as a specific apptype (for example, 80 for HTTP). | |
| name | Name of the match element to be executed when a callback occurs. (String) | |
| key | Name of the meta key that generates callbacks. (String) | |
| format | The data type of the meta key that will generate the meta. | |
| apptype | The meta callback is only generated if the session being parsed has been identified with the specified apptype. (Unsigned Integer, Optional) | |
| number | Defines a numeric variable that can be referenced elsewhere within the parser definition. All numeric values are 64-bit unsigned values. | |
| name | This is a unique identifier for the declaration. | |
| scope (optional) | Specifies when to reset the variable. This can either be for each side of a two-sided session or only after a new session is detected. The possible values are global, constant, stream, and session (default). | |
| string | Defines a numeric variable that can be referenced elsewhere within the parser definition. | |
| name | This is a unique identifier for the declaration. | |
| scope (optional) | Specifies when to reset the variable. This can either be for each side of a two-sided session or only after a new session is detected. The possible values are global, constant, stream, and session (default). | |
| port | Defines a match callback when a session is encountered using the specified port. The read position is set to the first byte of the first stream (client) in the session. | |
| name | This is a unique identifier for the declaration. | |
| value | This is the port number to identify. | |
| session | Defines a match callback for session begin/end events. These events only occur if a token for the parser is encountered in the session. | |
| name | This is a unique identifier for the declaration. | |
| value | Specifies that processing takes place at the beginning of a new session or at the end of a session (begin or end). | |
| stream | Defines a match callback for stream begin/end events. These events only occur if a token for the parser is encountered in the stream. | |
| name | This is a unique identifier for the declaration | |
| value | Specifies that processing takes place at the beginning or at the end of a stream (begin or end). | |
| function | Defines a match section that can be used as a generic function. No callbacks are associated with this declaration. | |
| name | This is a unique identifier for the declaration. | |
| meta | Defines the type of data that the parser will create. | |
| key | Specifies the key name. The key needs to be 1-16 bytes in size. | |
| format | Specifies the variant type (for example, Text, IPv4, UInt32). Refer to the SDK documentation for a full list. | |
| pattern | Defines a regular expression variable for use by the regex function | |
| name | This is a unique identifier for the declaration. | |
| scope (optional) | Specifies when to reset the variable. This can be for each side of a two-sided session or only after a new session is detected. Possible values are global, constant, stream, and session (default). | |
| value (optional) | Specifies a regular expression to assign to the pattern variable. This attribute is only valid when the scope attribute is set to constant. | |
| match | The possible entries for taking an action once a match criterion has been found for a declaration. These nodes can be nested to provide deeper logic. There are several categories of execution elements (functions) that can appear as children of a match element:
|
