# Regarding signatures

**URL:** <https://community.zeek.org/t/regarding-signatures/1146>\
**Category:** Zeek\
**Created:** [March 9, 2007, 1:11pm UTC](https://community.zeek.org/t/regarding-signatures/1146 "2007-03-09T13:11:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ayyappa\_Suryanarayan](https://avatars.discourse-cdn.com/v4/letter/a/46a35a/32.png) [@Ayyappa\_Suryanarayan](https://community.zeek.org/u/Ayyappa_Suryanarayan)\
**Post date:** [March 9, 2007, 1:11pm UTC](https://community.zeek.org/t/regarding-signatures/1146/1 "2007-03-09T13:11:47Z")

</div>

Hi all,  
sorry a small correction in previous mail..

The signature that is to be matched is the following:  
signature gtalk\_test {  
event "gtalk test received"  
payload /\x17\x03\x01/  
}

I tried the following signature also

signature gtalk\_one {  
event "gtalk one received"  
payload /.{0,0}\x17/  
payload /.{1,1}\x03/  
payload /.{2,2}\x01/  
}

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/regarding-signatures/1146/2 "2022-05-06T15:38:12Z")

</div>