############################################################################
#                                                                          #
#  ettercap -- etter.filter.pcre -- filter source file                     #
#                                                                          #
#  Copyright (C) ALoR & NaGA                                               #
#                                                                          #
#  This program is free software; you can redistribute it and/or modify    #
#  it under the terms of the GNU General Public License as published by    #
#  the Free Software Foundation; either version 2 of the License, or       #
#  (at your option) any later version.                                     #
#                                                                          #
############################################################################

##
# This file contains some example of Perl Compatible Regulare Expressions.
# (see http://www.perldoc.com/perl5.8.0/pod/perlre.html)
#
# The pcre support is optional in ettercap and will be enables only if you
# have the libpcre installed.
# the compiler will warn you if you try to compile a filter that contains
# pcre expressions but you don't have libpcre.
##


# swap first two words of a udp packet

if (ip.proto == UDP) {
   pcre_regex(DATA.data, "^([^ ]*) *([^ ]*)", "$2 $1");
}

# matches 'foo' and the beginning of the line, then a word, then 'bar'

if (pcre_regex(DECODED.data, "^foo [^ ]+ bar")) {
   msg("found\n");
}


