i'm finding counterintuitive behaviour for the regexp in the "searchfor" attr_rewrite. i have the following attr_rewrite attr_rewrite_post-proxy { attribute = Framed-Route searchin = proxy_reply searchfor = "([0-9./]+) ([0-9.]+) ([0-9]+)(.*)" replacewith = "[%{2}]" new_attribute = no ignore_case = no max_matches = 1 append = no } so for a Framed-Route of "83.67.67.192/29 83.67.214.161 1" it should give me: %{1} = 83.67.67.192/29 83.67.214.161 1 %{2} = 83.67.214.161 %{3} = 1 but instead %{2} contains "83.67.214.161 1". see the radiusd -X logs: modcall[post-proxy]: module "attr_filter_post-proxy" returns updated for request 0 radius_xlat: '([0-9./]+) ([0-9.]+) ([0-9]+)(.*)' radius_xlat: '[83.67.214.161 1]' rlm_attr_rewrite: Changed value for attribute Framed-Route from '83.67.67.192/29 83.67.214.161 1' to '[83.67.214.161 1]' anywone know why this is? also the \d for [0-9] don't work! tariq