/usr/share/ettercap/etter.filter.pcre is in ettercap-common 1:0.8.2-2build1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 | ############################################################################
# #
# ettercap -- etter.filter.pcre -- filter source file #
# #
# Copyright (C) ALoR & NaGA #
# #
# This program is free software; you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
# the Free Software Foundation; either version 2 of the License, or #
# (at your option) any later version. #
# #
############################################################################
##
# This file contains some example of Perl Compatible Regulare Expressions.
# (see http://www.perldoc.com/perl5.8.0/pod/perlre.html)
#
# The pcre support is optional in ettercap and will be enables only if you
# have the libpcre installed.
# the compiler will warn you if you try to compile a filter that contains
# pcre expressions but you don't have libpcre.
##
# swap first two words of a udp packet
if (ip.proto == UDP) {
pcre_regex(DATA.data, "^([^ ]*) *([^ ]*)", "$2 $1");
}
# matches 'foo' and the beginning of the line, then a word, then 'bar'
if (pcre_regex(DECODED.data, "^foo [^ ]+ bar")) {
msg("found\n");
}
|