User guide

Reconnex Corporation

112

Release 7.0.0.4

any alphanumeric \c or \d

not alphanumeric ^\w

any space [\ \f \n \r \t]

not any space ^\s

any space or field delimiter [\ -\\ :-@ \[-‗ {-~ ]

not any space or field delimiter ^\p

case sensitivity off

case sensitivity on

[…]

character sets, e.g. [3-6a-c] = 3,4,5,6,a,b,c

x-y

character ranges T-X = T,U,V,W,X

invert, e.g. ^\0x0 are all characters except NULL

Create a Network Concept

Network concepts allow you to identify expressions and concepts within protocol header

information, including HTTP headers. This allows you to identify session-related information about

flows on your network, including what end user agents are in use for HTTP. Once you know the

agent's user string, you can use it to build a concept that will flag all objects using that agent.

In the case of HTTP, this is helpful for identifying spiders, robots, crawlers, types of webmail,

browser versions, and operating systems in use on your network.

You can also look for specific host information in headers. This can tell you if you how much

productivity you are losing to blog websites like Deadspin. Because the network concept tags all

objects going to that host, you can get an idea of how much of a problem it is.

1. Go to Policy Concepts.

2. Click on Add Concept.

3. Name the network concept (use uppercase only).

4. Describe the concept.

Note: There is a BLOGPOST standard concept that finds traffic to multiple blog websites. In

this example, that concept is being limited to only one of those sites and extended to find all

objects going to that site.