# About bro signature reg exp

**URL:** <https://community.zeek.org/t/about-bro-signature-reg-exp/5396>\
**Category:** Zeek\
**Created:** [August 1, 2018, 8:41am UTC](https://community.zeek.org/t/about-bro-signature-reg-exp/5396 "2018-08-01T08:41:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marchisio\_Claudio](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@Marchisio\_Claudio](https://community.zeek.org/u/Marchisio_Claudio)\
**Post date:** [August 1, 2018, 8:41am UTC](https://community.zeek.org/t/about-bro-signature-reg-exp/5396/1 "2018-08-01T08:41:10Z")

</div>

I’m studying about bro-script and bro-signature

In my signature file

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [August 1, 2018, 3:44pm UTC](https://community.zeek.org/t/about-bro-signature-reg-exp/5396/2 "2018-08-01T15:44:45Z")

</div>

Bro doesn't treat line breaks any special, you can just match against  
them with \r and/or \n. Try somethng like this:

&nbsp;&nbsp;&nbsp;&nbsp;payload /(|.\*[\r\n])Cache/

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/about-bro-signature-reg-exp/5396/3 "2022-05-06T15:45:57Z")

</div>