count inside a packet, possible?


Wonder if anybody could confirm or not if it is possible to count within
a packet, in Bro. What I mean is: if a single packet contains the string
'6xxx6xxx6xxx6', is it possible to use a counter to determine the number
of characters '6' in the string is 4?

I have been looking at the examples inside Bro where regular expressions
are used, so an option could be '6.+?6.+?6.+?6'. But this might not be
scalable if I need to count for several characters, and in my case, I
don't know the order in which the characters appear in the packet.

I am a Bro newbie, sorry for the question as I understand this might go
against regular practices (as one might prefer to do a fast matching of
a packet). But I am learning and have the question bugging me.

Many thanks,


Anybody here for the Bro Exchange, staying at the Rodeway Inn? If so, let's get together for dinner tonight. Please contact me offline at .

Charles "Chuck A. Fair