Nodes

• Node Name: parsers
• Attribute Name:
• Description: The root node in each definition file.

• Node Name:
• Attribute Name: xmins:xsi
• Description: Defines the namespace to use for the schema inclusion. This attribute is not required; however, language definition is not possible without it. This node must have the following value: http://www.w3.org/2001/XMLSchema-instance

• Node Name:
• Attribute Name: xsi:noNamespaceSchemaLocation
• Description: Defines the XSD schema validation file used to validate the language definition. This attribute is not required; however, language definition is not possible without it. This node must have the following value: parsers.xsd

• Node Name: parser
• Attribute Name:
• Description: The node that defines a single parser definition. This node must be directly under the parsers node. There can be more than one per file.

• Node Name:
• Attribute Name: name
• Description: The name that uniquely identifies the parser. This name should be short and succinct. This is used by the system to allow enabling and disabling. It should contain only the letters [a-z] and [A-Z].

• Node Name:
• Attribute Name: desc
• Description: Provides a friendly description of what the parser does.

• Node Name:
• Attribute Name: service
• Description: The unique number assigned to the session when identified.

• Node Name: declaration
• Attribute Name:
• Description: Delineates the definition. Each of these definitions can have an associated match entry.

• Node Name: token
• Attribute Name:
• Description: Specifies a definition for identifying a token somewhere in the session protocol. This defines a match callback when the specified tokens are encountered in a session payload. The read position is set to the byte immediately following the matched token.

• Node Name:
• Attribute Name: name
• Description: This is a unique identifier for the declaration.

• Node Name:
• Attribute Name: value
• Description: This is the exact token value to be identified.

• Node Name:
• Attribute Name: options
• Description: Options specify that the token should start on a new line or at an end of a line (linestart or linestop).

• Node Name: meta-callback
• Attribute Name:
• Description: Registers a callback for the flex parser whenever meta of a specific format is created. This can be further qualified to generate callbacks only for sessions that have been identified as a specific apptype (for example, 80 for HTTP).

• Node Name:
• Attribute Name: name
• Description: Name of the match element to be executed when a callback occurs. (String)

• Node Name:
• Attribute Name: key
• Description: Name of the meta key that generates callbacks. (String)

• Node Name:
• Attribute Name: format
• Description: The data type of the meta key that will generate the meta.

• Node Name:
• Attribute Name: apptype
• Description: The meta callback is only generated if the session being parsed has been identified with the specified apptype. (Unsigned Integer, Optional)

• Node Name: number
• Attribute Name:
• Description: Defines a numeric variable that can be referenced elsewhere within the parser definition. All numeric values are 64-bit unsigned values.

• Node Name:
• Attribute Name: name
• Description: This is a unique identifier for the declaration.

• Node Name:
• Attribute Name: scope (optional)
• Description: Specifies when to reset the variable. This can either be for each side of a two-sided session or only after a new session is detected. The possible values are global, constant, stream, and session (default).

• Node Name: string
• Attribute Name:
• Description: Defines a numeric variable that can be referenced elsewhere within the parser definition.

• Node Name:
• Attribute Name: name
• Description: This is a unique identifier for the declaration.

• Node Name:
• Attribute Name: scope (optional)
• Description: Specifies when to reset the variable. This can either be for each side of a two-sided session or only after a new session is detected. The possible values are global, constant, stream, and session (default).

• Node Name: port
• Attribute Name:
• Description: Defines a match callback when a session is encountered using the specified port. The read position is set to the first byte of the first stream (client) in the session.

• Node Name:
• Attribute Name: name
• Description: This is a unique identifier for the declaration.

• Node Name:
• Attribute Name: value
• Description: This is the port number to identify.

• Node Name: session
• Attribute Name:
• Description: Defines a match callback for session begin/end events. These events only occur if a token for the parser is encountered in the session.

• Node Name:
• Attribute Name: name
• Description: This is a unique identifier for the declaration.

• Node Name:
• Attribute Name: value
• Description: Specifies that processing takes place at the beginning of a new session or at the end of a session (begin or end).

• Node Name: stream
• Attribute Name:
• Description: Defines a match callback for stream begin/end events. These events only occur if a token for the parser is encountered in the stream.

• Node Name:
• Attribute Name: name
• Description: This is a unique identifier for the declaration

• Node Name:
• Attribute Name: value
• Description: Specifies that processing takes place at the beginning or at the end of a stream (begin or end).

• Node Name: function
• Attribute Name:
• Description: Defines a match section that can be used as a generic function. No callbacks are associated with this declaration.

• Node Name:
• Attribute Name: name
• Description: This is a unique identifier for the declaration.

• Node Name: meta
• Attribute Name:
• Description: Defines the type of data that the parser will create.

• Node Name:
• Attribute Name: key
• Description: Specifies the key name. The key needs to be 1-16 bytes in size.

• Node Name:
• Attribute Name: format
• Description: Specifies the variant type (for example, Text, IPv4, UInt32). Refer to the SDK documentation for a full list.

• Node Name: pattern
• Attribute Name:
• Description: Defines a regular expression variable for use by the regex function

• Node Name:
• Attribute Name: name
• Description: This is a unique identifier for the declaration.

• Node Name:
• Attribute Name: scope (optional)
• Description: Specifies when to reset the variable. This can be for each side of a two-sided session or only after a new session is detected. Possible values are global, constant, stream, and session (default).

• Node Name:
• Attribute Name: value (optional)
• Description: Specifies a regular expression to assign to the pattern variable. This attribute is only valid when the scope attribute is set to constant.

• Node Name: match
• Attribute Name:
• Description: The possible entries for taking an action once a match criterion has been found for a declaration. These nodes can be nested to provide deeper logic. There are several categories of execution elements (functions) that can appear as children of a match element:
  • General
  • Arithmetic
  • String
  • Payload