regex101: Layer7 Filter for HTTP

^start of string

1st Alternativeget

getthe literal text get (case insensitive)

2nd Alternativepost

postthe literal text post (case insensitive)

3rd Alternativehead

headthe literal text head (case insensitive)

4th Alternativeoptions

optionsthe literal text options (case insensitive)

5th Alternativeput

putthe literal text put (case insensitive)

6th Alternativedelete

deletethe literal text delete (case insensitive)

7th Alternativetrace

tracethe literal text trace (case insensitive)

8th Alternativeconnect

connectthe literal text connect (case insensitive)

the literal (32₁₀ / 40₈ / 20₁₆)

Character Class[\x09-\x0d -~]*?

*?matches any number of characters from the set below:

\x09-\x0done character from (9₁₀) to ↵ (13₁₀)

-~one character from (32₁₀) to ~ (126₁₀)

httpthe literal text http (case insensitive)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Group 2(0\.9|1\.0|1\.1)

1st Alternative0\.9

0the literal 0 (48₁₀ / 60₈ / 30₁₆)

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

9the literal 9 (57₁₀ / 71₈ / 39₁₆)

2nd Alternative1\.0

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

0the literal 0 (48₁₀ / 60₈ / 30₁₆)

3rd Alternative1\.1

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

2nd Alternative^http\/(0\.9|1\.0|1\.1) [1-5][0-9][0-9]

^start of string

httpthe literal text http (case insensitive)

\/the literal / (47₁₀ / 57₈ / 2F₁₆)

Group 3(0\.9|1\.0|1\.1)

1st Alternative0\.9

0the literal 0 (48₁₀ / 60₈ / 30₁₆)

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

9the literal 9 (57₁₀ / 71₈ / 39₁₆)

2nd Alternative1\.0

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

0the literal 0 (48₁₀ / 60₈ / 30₁₆)

3rd Alternative1\.1

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

the literal (32₁₀ / 40₈ / 20₁₆)

Character Class[1-5]

1-5one character from 1 (49₁₀) to 5 (53₁₀)

Character Class[0-9]

0-9one character from 0 (48₁₀) to 9 (57₁₀)

Character Class[0-9]

0-9one character from 0 (48₁₀) to 9 (57₁₀)

Global pattern flags

s modifier: single line. Allows a dot to match line terminators

i modifier: insensitive. Matches without distinguishing uppercase and lowercase letters

Search reference

Regular Expression

^(get|post|head|options|put|delete|trace|connect) [\x09-\x0d -~]*? http\/(0\.9|1\.0|1\.1)|^http\/(0\.9|1\.0|1\.1) [1-5][0-9][0-9]

New

HTTP/1.1 206 Partial Content
Server: nginx
Date: Wed, 11 Nov 2015 03:56:37 GMT
Content-Type: application/octet-stream
Content-Length: 356602
Last-Modified: Sat, 09 May 2015 01:02:03 GMT
Connection: keep-alive
Cache-Control: no-store
Pragma: no-cache
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-TCP-Info,X-Session-Info
X-TCP-Info: h0=1468775468;h1=1393591241;h2=2806702307;h3=4238532199;h4=1088413687;
X-Session-Info: addr=14.203.114.166;port=64848;argp=6.r_LuFhNjxnyyv1lFwH73LPg5P97q98pNwisQ1a9GcfM
Content-Range: bytes 221217390-221573991/345312900

...{moof....mfhd...........ctraf....tfhd... ............tfdt.......
.tj`...Asaiz........0....................................