STREAM::expression and regular expression

Can anyone confirm that the documentation in Wiki for the STREAM::expression is correct.

 

 

I'am searching throught the stream looking for e.g. :9097/ and replace it with / . I need to use a regular expression. (since I am going to use other ports also ;-))

 

 

I have tried with the following:

 

STREAM::expression "@:\d{1,6}\/@/@"

 

Based on the documentation in Wiki this should be correct, but i don't get any matches.

 

 

I have aslo tried

 

when HTTP_RESPONSE {

 

STREAM::enable

 

STREAM::expression "@\d{1,6}\/@/@"

 

}

 

when STREAM_MATCHED {

 

log local0. "***Stream match: [STREAM::match] ****"

 

}

 

 

and the output of this is

 

Oct 11 16:26:40 tmm tmm[1452]: Rule WAS51_Proxy : ***Stream match: d/ ***

 

 

Something tells me that this reqular expression thing is not working correctly. Any ideas?

 

 

Running 9.4.1