" config commandsyn keyword hogConfigStart config skipwhite nextgroup=hogConfigTypesyn match hogConfigType contained "\<classification\>" nextgroup=hogConfigTypeRegion skipwhitesyn region  hogConfigTypeRegion contained oneline	start=":"ms=s+1 end="$" contains=hogNumber,hogText keepend skipwhite" include commandsyn keyword hogIncStart	include  skipwhite nextgroup=hogIncRegionsyn region  hogIncRegion  contained  oneline  start="\>" contains=hogFileName,hogEnvvar end="$" keepend" preprocessor command" http_decode, minfrag, portscan[-ignorehosts]syn keyword hogPPrStart	preprocessor  skipwhite nextgroup=hogPPrsyn match hogPPr   contained  "\<spade\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr   contained  "\<spade-homenet\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr   contained  "\<spade-threshlearn\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr   contained  "\<spade-adapt\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr   contained  "\<spade-adapt2\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr   contained  "\<spade-adapt3\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr   contained  "\<spade-survey\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr   contained  "\<defrag\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr   contained  "\<telnet_decode\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr   contained  "\<rpc_decode\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr   contained  "\<bo\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr   contained  "\<stream\>" nextgroup=hogStreamRegion skipwhitesyn match hogPPr   contained  "\<stream2\>" nextgroup=hogStreamRegion skipwhitesyn match hogPPr   contained  "\<stream3\>" nextgroup=hogStreamRegion skipwhitesyn match hogPPr   contained  "\<http_decode\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr   contained  "\<minfrag\>" nextgroup=hogPPrRegion skipwhitesyn match hogPPr     contained "\<portscan[-ignorehosts]*\>" nextgroup=hogPPrRegion skipwhitesyn region  hogPPrRegion contained oneline	start="$" end="$" keependsyn region  hogPPrRegion contained oneline	start=":" end="$" contains=hogNumber,hogIPaddr,hogEnvvar,hogFileName keependsyn keyword hogStreamArgs contained timeout ports maxbytessyn region hogStreamRegion contained oneline start=":" end="$" contains=hogStreamArgs,hogNumber" output commandsyn keyword hogOutStart	output  nextgroup=hogOut skipwhite"" alert_syslog syn match hogOut   contained  "\<alert_syslog\>" nextgroup=hogSyslogRegion skipwhitesyn region hogSyslogRegion  contained start=":" end="$" contains=hogSysFac,hogSysPri,hogSysOpt,hogEnvvar oneline skipwhite keepend"" alert_fast (full,smb,unixsock, and tcpdump)syn match hogOut   contained  "\<alert_fast\|alert_full\|alert_smb\|alert_unixsock\|log_tcpdump\>" nextgroup=hogLogFileRegion skipwhitesyn region hogLogFileRegion  contained start=":" end="$" contains=hogFileName,hogEnvvar oneline skipwhite keepend"" databasesyn match hogOut  contained "\<database\>" nextgroup=hogDBTypes skipwhitesyn region hogDBTypes contained start=":" end="," contains=hogDBType,hogEnvvar nextgroup=hogDBSRVs skipwhite syn region hogDBSRVs contained start="\s\+" end="," contains=hogDBSRV nextgroup=hogDBParams skipwhite syn region hogDBParams contained start="." end="="me=e-1 contains=hogDBParam  nextgroup=hogDBValuessyn region hogDBValues contained start="." end="\>" contains=hogNumber,hogEnvvar,hogAscii nextgroup=hogDBParams oneline skipwhitesyn match hogAscii contained "\<\a\+" "" log_tcpdumpsyn match hogOut   contained  "\<log_tcpdump\>" nextgroup=hogLogRegion skipwhitesyn region  hogLogRegion  oneline	start=":" skipwhite end="$" contains=hogEnvvar,hogFileName keepend"" xmlsyn keyword hogXMLTrans contained http https tcp iapsyn match hogOut     contained "\<xml\>" nextgroup=hogXMLRegion skipwhitesyn region hogXMLRegion contained start=":" end="," contains=hogXMLArg,hogEnvvar nextgroup=hogXMLParams skipwhite "syn region hogXMLParams contained start="." end="="me=e-1 contains=hogXMLProto nextgroup=hogXMLProtos "syn region hogXMLProtos contained start="." end="\>" contains=hogXMLTrans nextgroup=hogXMLParamssyn region hogXMLParams contained start="." end="="me=e-1 contains=hogXMLParam  nextgroup=hogXMLValuesyn region hogXMLValue contained start="." end="\>" contains=hogNumber,hogIPaddr,hogEnvvar,hogAscii,hogFileName nextgroup=hogXMLParams oneline skipwhite keepend"" Filenamesyn match   hogFileName  contained "[-./[:alnum:]_~]\+"syn match   hogFileName  contained "[-./[:alnum:]_~]\+"" IP addresssyn match   hogIPaddr   "\<\d\{1,3}\.\d\{1,3}\.\d\{1,3}\.\d\{1,3}\>"syn match   hogIPaddr   "\<\d\{1,3}\.\d\{1,3}\.\d\{1,3}\.\d\{1,3}/\d\{1,2}\>"syn keyword hogProto	tcp TCP ICMP icmp udp UDP" hog alert address port pairs" hog IPaddressessyn match   hogIPaddrAndPort contained  "\<\d\{1,3}\.\d\{1,3}\.\d\{1,3}\.\d\{1,3}\>" skipwhite                  nextgroup=hogPortsyn match   hogIPaddrAndPort contained  "\<\d\{1,3}\.\d\{1,3}\.\d\{1,3}\.\d\{1,3}/\d\{1,2}\>" skipwhite         nextgroup=hogPortsyn match   hogIPaddrAndPort contained "\<any\>" skipwhite nextgroup=hogPortsyn match hogIPaddrAndPort contained     "\$\I\i*" nextgroup=hogPort skipwhitesyn match hogIPaddrAndPort contained     "\${\I\i*}" nextgroup=hogPort skipwhite"syn match   hogPort contained "[\!]\=[\:]\=\d\+L\=\>" skipwhitesyn match   hogPort contained "[\:]\=\d\+\>" syn match   hogPort contained "[\!]\=\<any\>" skipwhitesyn match   hogPort contained "[\!]\=\d\+L\=:\d\+L\=\>" skipwhite" action commandssyn keyword hog7Functions activate skipwhite nextgroup=hogActRegionsyn keyword hog7Functions dynamic skipwhite nextgroup=hogActRegionsyn keyword hogActStart alert skipwhite nextgroup=hogActRegionsyn keyword hogActStart log skipwhite nextgroup=hogActRegionsyn keyword hogActStart pass skipwhite nextgroup=hogActRegionsyn region hogActRegion contained oneline start="tcp\|TCP\|udp\|UDP\|icmp\|ICMP" end="\s\+"me=s-1 nextgroup=hogActSource oneline keepend skipwhitesyn region hogActSource contained oneline contains=hogIPaddrAndPort start="\s\+"ms=e+1 end="->\|<>"me=e-2  oneline keepend skipwhite nextgroup=hogActDestsyn region hogActDest contained oneline contains=hogIPaddrAndPort start="->\|<>" end="$"  oneline keependsyn region hogActDest contained oneline contains=hogIPaddrAndPort start="->\|<>" end="("me=e-1  oneline keepend skipwhite nextgroup=hogRules" ====================if version >= 508 || !exists("did_hog_syn_inits")  if version < 508    let did_hog_syn_inits = 1    command -nargs=+ HiLink hi link <args>  else    command -nargs=+ HiLink hi def link <args>   endif" The default methods for highlighting.  Can be overridden later  HiLink hogComment		Comment  HiLink hogLineComment	Comment  HiLink hogAscii		Constant  HiLink hogCommentString	Constant  HiLink hogFileName		Constant  HiLink hogIPaddr		Constant  HiLink hogNotPatSep		Constant  HiLink hogNumber		Constant  HiLink hogText		Constant  HiLink hogString		Constant  HiLink hogSysFac		Constant  HiLink hogSysOpt		Constant  HiLink hogSysPri		Constant"  HiLink hogAStrGrp		Error  HiLink hogJunk		Error  HiLink hogEnvvar		Identifier  HiLink hogIPaddrAndPort	Identifier  HiLink hogVarIdent		Identifier  HiLink hogATAGOpt		PreProc  HiLink hogAIPOptVal		PreProc  HiLink hogARespOpt		PreProc  HiLink hogAReactOpt		PreProc  HiLink hogAFlagOpt		PreProc  HiLink hogAFragOpt		PreProc  HiLink hogCommentTitle	PreProc  HiLink hogDBType		PreProc  HiLink hogDBSRV		PreProc  HiLink hogPort		PreProc  HiLink hogARefGrps		PreProc  HiLink hogSessionVal		PreProc  HiLink hogXMLArg		PreProc  HiLink hogARPCOpt		PreProc  HiLink hogPatSep		Special  HiLink hog7Functions		Statement  HiLink hogActStart		Statement  HiLink hogIncStart		Statement  HiLink hogConfigStart	Statement  HiLink hogOutStart		Statement  HiLink hogPPrStart		Statement  HiLink hogVarStart		Statement  HiLink hogRTypeStart		Statement  HiLink hogTodo		Todo  HiLink hogRuleType		Type  HiLink hogAFOpt		Type  HiLink hogANoVal		Type  HiLink hogAStrOpt		Type  HiLink hogANOpt		Type  HiLink hogAOpt		Type  HiLink hogDBParam		Type  HiLink hogStreamArgs		Type  HiLink hogOut		Type  HiLink hogPPr		Type  HiLink  hogConfigType	Type  HiLink hogActRegion		Type  HiLink hogProto		Type  HiLink hogXMLParam		Type  HiLink resp			Todo  HiLink cLabel         Label     delcommand HiLinkendiflet b:current_syntax = "hog"" hog: cpw=59