Generic TCP Decoder rules

The decoding engine implemented in the Generic TCP Module takes the provided rules and attempts to match incoming data from the Web Response Time Module API against those rules. When rules are matched successfully, the engine passes the matched data back to the Generic TCP Module, which processes and associates action sections against the matched rule. The actions accumulate the matched data until a completed transaction is observed, and the data can be published to the Web Response Time Module API as context.

ABNF rule definition

The Generic TCP Decoder uses ABNF syntax and defines protocol structure in a normalized way. The decoder supports ABNF syntax as defined in RFC 5234. This section describes where the decoder syntax deviates from the standard.

Rules for the decoder are listed in the rules section of the config block. Each rule has a name and a series of elements and is terminated by the end of line. RFC 5234 defines a rule as being terminated by an internet standard newline (commonly referred to as CRLF). An internet standard newline is a carriage return (character 0x0d) followed by a line feed (character 0x0a). The Generic TCP Decoder differs from RFC 5234 in that it allows both CRLF and single LF termination of rules. When the next rule line is not a rule definition, the line is interpreted as a continuation of the current rule.

For example: 
RuleA = DIGIT OCTET
is equivalent to: 
RuleA = DIGIT
			 OCTET
Comments may be included in the rule syntax. Comments are specified using the semicolon (;) character. Any text between the semicolon and the end of line is interpreted as a comment. Comments do not affect rule interpretation, so the following rule definitions are valid: 
RuleA = DIGIT OCTET ; A single digit followed by an octet
RuleA = DIGIT 	; A single digit
		   OCTET	; Followed by an octet

Basic rules

All rules are named. The name for a rule is part of the definition, and the rule is assigned the corresponding syntax 
rulename = rule-elements
Fastpath: RFC 5234 defines a rulename as starting with an alphabetic character, followed by any combination of other alphabetic characters, digits, and hyphens, and are not case sensitive. The Generic TCP Decoderdiffers in that rule names are case sensitive, and may also include underscore (_) characters.
Rule elements may be:
  • A terminal value (that is, a specific character, byte or string)
  • The name of another rule
  • A repetition of rule-elements
  • A sequence of rule-elements
  • A choice of alternative rule-elements