From f2e83e420dd7717e920b208c10c54e52a749f03e Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 6 Dec 2023 20:32:50 +0100 Subject: [PATCH] doc: fix byte_test examples As this keyword has 4 mandatory arguments, and some examples had only three... Ticket: 6629 (cherry picked from commit 4933b817aacc649edc52409426500a9ec271ccc6) --- doc/userguide/rules/payload-keywords.rst | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst index 412f7b4fe0e..9a609a217f0 100644 --- a/doc/userguide/rules/payload-keywords.rst +++ b/doc/userguide/rules/payload-keywords.rst @@ -412,23 +412,23 @@ Example:: alert tcp any any -> any any \ (msg:"Byte_Test Example - Num = Value"; \ - content:"|00 01 00 02|"; byte_test:2,=,0x01;) + content:"|00 01 00 02|"; byte_test:2,=,0x01,0;) alert tcp any any -> any any \ (msg:"Byte_Test Example - Num = Value relative to content"; \ - content:"|00 01 00 02|"; byte_test:2,=,0x03,relative;) + content:"|00 01 00 02|"; byte_test:2,=,0x03,2,relative;) alert tcp any any -> any any \ (msg:"Byte_Test Example - Num != Value"; content:"|00 01 00 02|"; \ - byte_test:2,!=,0x06;) + byte_test:2,!=,0x06,0;) alert tcp any any -> any any \ (msg:"Byte_Test Example - Detect Large Values"; content:"|00 01 00 02|"; \ - byte_test:2,>,1000,relative;) + byte_test:2,>,1000,1,relative;) alert tcp any any -> any any \ (msg:"Byte_Test Example - Lowest bit is set"; \ - content:"|00 01 00 02|"; byte_test:2,&,0x01,relative;) + content:"|00 01 00 02|"; byte_test:2,&,0x01,12,relative;) alert tcp any any -> any any (msg:"Byte_Test Example - Compare to String"; \ content:"foobar"; byte_test:4,=,1337,1,relative,string,dec;)