1

I am trying to parse SIP messages for all SIP codes from the range 400-699 EXCEPT 401 (it's used for client authentication and fills our logs with garbage).

The messages look like this (small subset, there's a huge number of codes and I'd like to avoid listing them all out):

SIP/2.0 400 Bad Request
SIP/2.0 401 Unauthorized
SIP/2.0 500 Internal Server Error
SIP/2.0 604 Does not exist anywhere

Here is my current regex (doesn't work, still trying to figure this out so please excuse if it's not the most elegant)

(?m)^SIP/2\.0\s(400|40[2-9]|4[1-90-9]|[5-60-90-9]).*$

I can't seem to hunt down whether or not PCRE supports character class subtraction without finding a bunch of PHP info. Any help getting this working would be really helpful. Thank you!!!

Edit: Just modified the REGEX. I'm closer, but it's still including 401 messages.

Matthew
  • 512
  • 1
  • 6
  • 16

1 Answers1

3

[1-90-9] is equal to [0-9] seems you had something different in your mind plz explain what is your expectation

hostmaster
  • 1,822
  • 16
  • 17
  • I am trying to select any number from 400-499, excluding 401. So, 400 is specified literally, then I create a range for 402-409. Then, I create a range for 410-499. Based on the explanations I found, that is the correct way to go about it - http://www.regular-expressions.info/numericranges.html – Matthew Aug 28 '12 at 16:10
  • (?m)^SIP/2\.0\s(400|40[2-9]|4[1-9][0-9]|[5-6][0-9][0-9]).*$ Seems to have resolved the issue, I was treating it incorrectly as you said. Thank you! – Matthew Aug 28 '12 at 16:12