Skip to content

Commit

Permalink
doc: fix byte_test examples
Browse files Browse the repository at this point in the history
As this keyword has 4 mandatory arguments, and some examples
had only three...

Ticket: 6629
(cherry picked from commit 4933b81)
  • Loading branch information
catenacyber authored and victorjulien committed Jan 9, 2024
1 parent 2e6322b commit f2e83e4
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions doc/userguide/rules/payload-keywords.rst
Original file line number Diff line number Diff line change
Expand Up @@ -412,23 +412,23 @@ Example::

alert tcp any any -> any any \
(msg:"Byte_Test Example - Num = Value"; \
content:"|00 01 00 02|"; byte_test:2,=,0x01;)
content:"|00 01 00 02|"; byte_test:2,=,0x01,0;)

alert tcp any any -> any any \
(msg:"Byte_Test Example - Num = Value relative to content"; \
content:"|00 01 00 02|"; byte_test:2,=,0x03,relative;)
content:"|00 01 00 02|"; byte_test:2,=,0x03,2,relative;)

alert tcp any any -> any any \
(msg:"Byte_Test Example - Num != Value"; content:"|00 01 00 02|"; \
byte_test:2,!=,0x06;)
byte_test:2,!=,0x06,0;)

alert tcp any any -> any any \
(msg:"Byte_Test Example - Detect Large Values"; content:"|00 01 00 02|"; \
byte_test:2,>,1000,relative;)
byte_test:2,>,1000,1,relative;)

alert tcp any any -> any any \
(msg:"Byte_Test Example - Lowest bit is set"; \
content:"|00 01 00 02|"; byte_test:2,&,0x01,relative;)
content:"|00 01 00 02|"; byte_test:2,&,0x01,12,relative;)

alert tcp any any -> any any (msg:"Byte_Test Example - Compare to String"; \
content:"foobar"; byte_test:4,=,1337,1,relative,string,dec;)
Expand Down

0 comments on commit f2e83e4

Please sign in to comment.