# Using a 'OR' condition in Signature payloads **URL:** \ **Category:** Zeek\ **Created:** [October 31, 2006, 3:02am UTC](https://community.zeek.org/t/using-a-or-condition-in-signature-payloads/1043 "2006-10-31T03:02:56Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Jaya\_Dhanesh](https://avatars.discourse-cdn.com/v4/letter/j/7feea3/32.png) [@Jaya\_Dhanesh](https://community.zeek.org/u/Jaya_Dhanesh)\ **Post date:** [October 31, 2006, 3:02am UTC](https://community.zeek.org/t/using-a-or-condition-in-signature-payloads/1043/1 "2006-10-31T03:02:56Z")
Hi All, I was trying to implement an 'OR' condition in the signature payload to match either of the two patterns given in payload. For example: signature abc-21 {   ip-proto == tcp   . . . .   . . . .   payload /.\*(abc) | (xyz).\*/ } When I run Bro with this signature, I was able to see a log for the packet that matches the pattern first.i.e., the packet with abc or xyz (whichever comes first) gets logged and the rest doesn't generate a log. Only one pattern matches always and the others go unnoticed. Is there anything wrong in writing the 'OR' condition? Thanks in advance, Dhanesh. ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [October 31, 2006, 3:08am UTC](https://community.zeek.org/t/using-a-or-condition-in-signature-payloads/1043/2 "2006-10-31T03:08:37Z")
>   payload /.\*(abc) | (xyz).\*/ > ... > Is there anything wrong in writing the 'OR' condition? Yes, this should be written instead as:   payload /.\*(abc)|(xyz).\*/ Or, if you want to match "abc" or "xyz" anywhere in the payload, as:   payload /.\*(abc|xyz).\*/ - Vern ---
**Author:** ![Jaya\_Dhanesh](https://avatars.discourse-cdn.com/v4/letter/j/7feea3/32.png) [@Jaya\_Dhanesh](https://community.zeek.org/u/Jaya_Dhanesh)\ **Post date:** [October 31, 2006, 3:51am UTC](https://community.zeek.org/t/using-a-or-condition-in-signature-payloads/1043/3 "2006-10-31T03:51:32Z")
Hi, > Yes, this should be written instead as: > payload /.\*(abc)|(xyz).\*/ > Or, if you want to match "abc" or "xyz" anywhere in the payload, as: > payload /.\*(abc|xyz).\*/ I wrote the same pattern in the payload, only the first packet that matches the pattern (either 'abc' or 'xyz')gets logged. Bro checks for the pattern in each packet, so I should have got logs for all the packets that has atleast one of the patterns. Dhanesh. ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [October 31, 2006, 8:32am UTC](https://community.zeek.org/t/using-a-or-condition-in-signature-payloads/1043/4 "2006-10-31T08:32:27Z")
>   payload /.\*(abc) | (xyz).\*/ > } > > When I run Bro with this signature, I was able to see a log for the packet > that matches the pattern first.i.e., the packet with > abc or xyz (whichever comes first) gets logged and the rest doesn't generate > a log. > Only one pattern matches always and the others go unnoticed. > > Is there anything wrong in writing the 'OR' condition? I believe what's going on is that "payload" is matching the TCP \*byte-stream\* rather than individual packets. As such, there's just one match to the pattern, since the .\*'s eat up everything else in the byte-stream. There's an option to just match packet payloads, but I don't recall what it is. I've cc'd Robin since he's the expert on the signature engine.     Vern ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [November 1, 2006, 12:44am UTC](https://community.zeek.org/t/using-a-or-condition-in-signature-payloads/1043/5 "2006-11-01T00:44:29Z")
> I believe what's going on is that "payload" is matching the TCP \*byte-stream\* > rather than individual packets. As such, there's just one match to the > pattern, since the .\*'s eat up everything else in the byte-stream. That's right. > There's an option to just match packet payloads, but I don't recall what > it is. No, there is no option (UDP is matched packet-wise but even for UDP Bro reports each signature-match only once per UDP flow). Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/using-a-or-condition-in-signature-payloads/1043/6 "2022-05-06T15:38:01Z")
Closed on May 6, 2022, 3:38pm UTC