# Patterns and Word Boundaries
**URL:** https://community.zeek.org/t/patterns-and-word-boundaries/3880
**Category:** Zeek
**Created:** [October 22, 2015, 3:05pm UTC](https://community.zeek.org/t/patterns-and-word-boundaries/3880 "2015-10-22T15:05:18Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Lloyd\_Brown](https://community.zeek.org/u/Lloyd_Brown)
#### Post date: [October 22, 2015, 3:05pm UTC](https://community.zeek.org/t/patterns-and-word-boundaries/3880/1 "2015-10-22T15:05:18Z")
Hopefully this isn't too simplistic of a question, but I'm just getting
started with Bro.
In the text pattern syntax for Bro [1], is there an easy way to define
word boundaries, similar to how some of the RegEx dialects use '\b',
'\\<', '\\>', etc.? [2]
I'm trying to match for specific strings in a data stream. For example,
the word "nmap". I'm trying several approaches, based on past RegEx
knowledge, and I'm having trouble coming up with a single pattern that
would handle it all. Example bro test script attached; hopefully it's
clear.
Fundamentally, is there a syntax reference for pattern matching, or does
it conform to a commonly known dialect (eg. POSIX-style RegEx, or PCRE
RegEx)?
[1] [https://www.bro.org/sphinx/scripting/index.html#pattern](https://www.bro.org/sphinx/scripting/index.html#pattern)
[2] [Regex Tutorial - \b Word Boundaries](http://www.regular-expressions.info/wordboundaries.html)
[patterns.wordboundary.testcase.bro](https://community.zeek.org/uploads/short-url/tUq7VGqyDZzczcZH5tnyFqWCTgU.bro) (1.47 KB)
---
### Author:  [@Samuel\_Oehlert](https://community.zeek.org/u/Samuel_Oehlert)
#### Post date: [October 22, 2015, 4:03pm UTC](https://community.zeek.org/t/patterns-and-word-boundaries/3880/2 "2015-10-22T16:03:45Z")
I know Bro’s regex syntax is almost exactly the same as Flex (only differing in some very edge cases). I am not positive, but from a cursory google it seems Flex doesn’t understand word boundaries.
-Sam
---
### Author:  [@Lloyd\_Brown](https://community.zeek.org/u/Lloyd_Brown)
#### Post date: [October 22, 2015, 5:08pm UTC](https://community.zeek.org/t/patterns-and-word-boundaries/3880/3 "2015-10-22T17:08:50Z")
Well, okay. From what I can tell experimentally, it doesn't have
working shortcuts like "\s" or "[:space:]" either, so I guess I'm left
to do it more like \*this\* attachment.
Unless I'm missing something obvious. I'd be happy to be wrong on this one.
Lloyd Brown
Systems Administrator
Fulton Supercomputing Lab
Brigham Young University
[http://marylou.byu.edu](http://marylou.byu.edu)
[patterns.wordboundary.testcase.bro](https://community.zeek.org/uploads/short-url/vVeOE1Qe6Ox1PWtUxFhzsevLUjc.bro) (889 Bytes)
---
### Author:  [@robin](https://community.zeek.org/u/robin)
#### Post date: [October 22, 2015, 6:40pm UTC](https://community.zeek.org/t/patterns-and-word-boundaries/3880/4 "2015-10-22T18:40:49Z")
It does actually support the standard "[:...:]" cases.
Robin
---
### Author:  [@Lloyd\_Brown](https://community.zeek.org/u/Lloyd_Brown)
#### Post date: [October 22, 2015, 9:32pm UTC](https://community.zeek.org/t/patterns-and-word-boundaries/3880/5 "2015-10-22T21:32:09Z")
For future list-viewers, yes, I was missing something obvious. The word
boundaries are genuinely missing, but I was using the shortcuts like
'[:space:]' incorrectly.
In short, '[:space:]' and others like it, are not character classes
themselves, but they can exist in a character class. The '[:space:]' is
not the equivalent of '[\f\n\r\t\v]', but '[[:space:]]' is.
Thanks for the feedback on this, Robin. Sorry for the unnecessary list
noise.
Lloyd Brown
Systems Administrator
Fulton Supercomputing Lab
Brigham Young University
[http://marylou.byu.edu](http://marylou.byu.edu)
---
### Author:  [@Daniel\_Guerra](https://community.zeek.org/u/Daniel_Guerra)
#### Post date: [October 22, 2015, 10:56pm UTC](https://community.zeek.org/t/patterns-and-word-boundaries/3880/6 "2015-10-22T22:56:28Z")
Have you read this ??
[http://flex.sourceforge.net/manual/Patterns.html](http://flex.sourceforge.net/manual/Patterns.html)
Regex != Flex
---
### Author:  [@Lloyd\_Brown](https://community.zeek.org/u/Lloyd_Brown)
#### Post date: [October 22, 2015, 11:03pm UTC](https://community.zeek.org/t/patterns-and-word-boundaries/3880/7 "2015-10-22T23:03:38Z")
Yes. I had seen that. And I just missed the double-bracket detail.
Having said that, this looks to me like as much of a RegEx dialect as
any other. Those extended shortcuts like I've been referring to are
reasonably common, but not required. And the first sentence on that
page even says the following:
> The patterns in the input ... are written using an extended set of regular expressions.
So Flex and RegEx at least share a lot of features and syntax. Whether
or not it's truly RegEx, seems like a purely semantic discussion.
Lloyd Brown
Systems Administrator
Fulton Supercomputing Lab
Brigham Young University
> **[Office of Research Computing - BYU](https://rc.byu.edu/)**
>
> Mission: To facilitate and enhance computationally-intensive research at BYU by providing reliable, state-of-the-art, high performance computing (HPC) resources to faculty and students.
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/patterns-and-word-boundaries/3880/8 "2022-05-06T15:43:10Z")