and welcome back. Let's be couple we left off. We actually already finding the data for time night. So let's organize us a little time here.
It's a little space corn that we're going to know what's what.
And now let's start looking for source. And you know what? This is getting a little clocked up.
I just actually delete this on the top already. Know what we're looking for? Just a little more organized. Right.
So we're gonna search again for sores.
I'm gonna check also for destination I p.
And in order to practice, um, sorry.
Us really gonna also search for the destination port.
Okay, Just so we could get a little practice in okay.
And sorry for the typos. Uh, here.
start working on this.
Okay? So sort is actually fairly simple.
one thing to remember is actually gonna need way too much information from behind. Like or doing out here with time. It's just
I would like you to practice
in this case, force, um, little to SRC like animation earlier. We don't need, so
that's right. Move it.
If he has no time here before so
it shouldn't really matter.
I can't remove it from there.
Start working with the source. S R C
Flash D right and I. P's are from 13 Correct.
That's right. I'm racket
and then break. It was period and then we do this basically
and I was removed a period at the end. And guess what? You have a drink.
But like I said, always look for something after all this time it's a colon
that's a foul. It let's at the capture group
and there you go. Then we're adding capture groups. Since they started. Look, sources, lock sources both. We were practicing as if we're going to integrate this into it s I am so sleepy. We just do this and that's basically it.
Now for destination I p. It's fairly simple. It's facing the same syntax just instead of SRC is destination, right?
we type it like this and we're done
See discounts with practice rates. You already know how this works. You already know at seen this before and therefore you know what changes you need today An I P is an I p s along with his i p before and the locks are so we're using is still gonna be four octaves of wanted three digits And you can see here that there's once I have
one did it and he chucked It is he wants after easy ones have to some of the doctors and you can see that they
Rogic's itself It's working how it's supposed to be working
we now need to look for
Now when we look for deport itself,
Um, it's basically ad
to the side of what we're doing, right? And if you remember correctly from a prior lesson, it's between 15 digits of flint again you can use per square brackets and put the exact range. But
let's just say 1 to 5. Uh, unlikely should cover it right now. Obviously, like I mentioned earlier, if it s i n. You want to make sure you captured a port, not the AP,
so you have to treat it records in. Let's see, you're gonna make an error here, see if you can detect it.
Why? This is not our my network, right
to give you a second to think what has happened, right?
you know, sent into a little secret
if you come right here, Yes, there's ever
invalid. Quantify, Right.
no sovereign diseases in the wrong place, is it?
Let's put it right here. And obviously,
this should know. Go over. Apologize
Small screen on. As you can see, it is now
fully working. So let's put this actually not cheat sheet
and ***. And actually, that's actually at I p
and removed this in case of the P,
obviously, to fix the capture group actually had them earlier,
right? And effort of the century party. In that space of this same thing,
source repeats the same syntax. Justine S R c, for sources said of D
for destination. Right, D s t.
this is much, much the only day it's that remember
never your ability A rule always at something at the end. In this case for the destination port,
you should be adding that little
cola at the end to make sure it captures it correctly. Right?
And there we go. Now
let's say you want to capture the data at the Ennis. Well,
that one, for example, type of connection. Then basically, you have to do it's to ah
w plus, and that basically takes care of it.
Now regards to Particle. You know, at a word of swell.
And basically, when you're at this, you're taking care of the forward. Same tax if you want one.
But if you see carefully here, right
there we go. Now it's not over shouting to the next cream. That's why you have to always look at the next character.
All right, in there, really now is capturing the type.
Put in our she cheat again,
Let's say this is apology since here
you say it's time, I guess, right?
Yeah, let's say critical
again. Like all the previous instances, you have to write too much farces. Particle. It's itself the word. It's the pretext if you want to call them dead.
I was captured the next tech, which in this case would be
that's a that DCP right being you to be artistic P
and I was that the next character or the little slash is actually the afterward bracket and therefore that leads to what we actually need to capture for this case
now, staying in the protocol. It's actually copy and paste is into our Cici.
All right, then that's what you'll see here. We have fused
while card, and I'm gonna show you a little secret here.
So this copy protocol again
and say it is still protocol right in. There we go.
I should be taken to curve it.
Now. One important thing that we have miss is the message.
What's the point of having a source in the destination and particle it took if you don't know, actually, what actually was taking right? And like in previous cases, you can use an SGS a pretext
and your convertible, actually.
All right, what's this usedto w right
for a message on in this case because he clearly
message to has some symbols we might need to add
into our rule. Right,
So let's at dad over here
and its added at the inn, and you might see that in my break are not detected. And the recent being is dead.
more than one word and honestly if it's just you're telling the suffer? A. It's just one word. Doesn't matter the length,
but I want to see a quotation at the end of this. And there's a space here. It's not technically one word anymore. And technically, we're gonna have to have two words. So
let's try this again. Right?
You gonna say Okay, it's 12 words. So list of space,
which is last mess, right?
And then if it's there or not there,
and then we get into another.
That's, uh, lift ISS, right? Sorry.
All right. If it's they're not there.
I'm sorry. Morning. One character I apologize
close bracket against. He now has been detected, most of them. But you can still sort of see that.
Not all of it. It's being captured. We actually look at the second string over there. You can see the little white space. And basically what happens is if the action has more than two words,
this will not be detected.
And this is when wild cards
come into play. Right?
take a quick look into the Israeli. Let's eliminate this. We have to
square brackets again endless to the wild card and like a mention where it is a very common when I use and you can see now pretty much
that all of them are being that took all the messages right, including this one, which earlier was not able to be detected due to having more than two words. And that's why I say you have to be really, really careful when you build these. Okay,
um, you can, for example, avoid seeing a real threat because you were too precise, too exact when you were building the magics and we were not counting into data you have not yet seen
You don't want to always use while cars fits a lot of stress on the system, but also you don't want to be too precise. We might lose events like this.
Just one example. You know, if it's
invoice 12345 Instead of writing 5 60 years, I will put like from one to from two up to eight digits. You know that we have a little leg room for improvement, increase mint and be a little more proficient. We're not here to play catching miles, right?
And then You know, like I said earlier, if you have a bigger infrastructure, you might consider
including the idea on the farm. All he will be a very similar concept. Right? I d s slashed. Ah, equal sign slash W plus. And then the first letter of the next word, for example. Issue take care of it, right. He should be able to build magics just about everything around here.
wild card is fun. But one of the issues if while cars is, for example, you try to go back to our time rejects, it won't work since while car will detect the whole segment and not just
the date or just the time. And that's when Magic sister might need to build two different Radic. Says one for the date. Want for the time in order to properly determine what you're looking for.
message here, Right,
Have another alternative
and therefore me updated. Archie cheat, if you want to call it that. Right?
And again, we have learned so far in the lesson how to use,
um, all of these difference a concept, right? You have basically learned that even though we do have a horse for, like multiple captured groups,
again slept that efficient endeavor I did not recommend using or for security appliance that it puts a lot of stress. And and again, if all have to have run more than one alternative, you can comfort, curate and hit this little plus button, you'll be ableto
write several since Texas. Very simple sentences which will work ASA or statement without having to actually have the system hold this cache of stores with sent exit of search right to be able to work properly. Like I said, you have to learn all the concentrator seeing the cheat sheet that you probably is your day today,
right? I'll be using all this concert of Cory length
the words digits, the wild cards, the capture groups. If you use all this in my everyday live right and it's just very little, you will not be learning right. Like
basically what you see in this course will be what you be doing. That word
out of what you've seen here today, you won't not be using as often unless you're more into the programming aspect off Red IX
again. While cart is your friend. Do not forget.
the overall in this course you learned Barrow, things aren't red X. It's basically a syntax or search pattern. Have dancers. Pardon?
That's so not so wild. Wild card, right,
that less is better in it, right? You don't have to write this complex things.
Keeping it simple is always the best opportunity and usually test this script writer this syntax online and in the tool. And even though your morning between tools is always good for a dead now,
the over it's nice was always fated to have two different Semtex is than one complex one. Okay,
it is also very, very Amiri. Say this again, Very important
that you look for data prior and after what you want to capture. Why? Because this way you will eliminate the chances of false positive on capturing the wrong group. When the techs excels, changes are for things here haven't seen before. And again, there's always more than one way to write at Reg IX.
Just because you do it this way doesn't mean
that your partner did it wrong or your professor did it wrong when your manager did it wrong. doesn't mean that just because everyone else has it 11 doesn't mean you jerk. Regis's run right?
There's more than one way to build a tragic and I need
Keep that in your head.
Don't close your eyes. Don't don't closer mind thinking I was not able to do this because you might be able to write. It's just simplicity. Maybe tackle it in a different way and you should be able to manage it.
I hope you enjoy this course.
I hope to see you soon. Future courses. I encourage you to take other Siiri courses. You know there's different aspects from cybersecurity, different levels. All of them will be a great advantage for us. A professional. I encourage you to take them.
Some of them are very short. Some of our more in depth. It all suits your time availability at which your great day internalize your class. Good night.