Meta tags:
description=;

Headings (most frequently used words):

snort, rule, writing, guide, byte_math, format, examples,

Text of the page (most frequently used words):
the (58), and (30), bytes (21), string (16), options (15), result (13), rule (13), #byte_math (12), offset (11), snort (10), specific (10), from (9), value (9), operation (9), valid (8), rvalue (8), extracted (8), variable (8), followed (8), endian (8), with (7), bitmask (7), packet (7), rules (7), number (6), must (6), values (6), are (6), include (6), content (5), option (5), oper (5), relative (5), extract (5), that (5), mathematical (5), writing (5), detection (5), extracts (4), stores (4), dec (4), argument (4), note (4), dce (4), used (4), this (3), arguments (3), area (3), byte_test (3), using (3), count (3), perform (3), accompanied (3), oct (3), hex (3), use (3), big (3), buffer (3), name (3), byte_extract (3), operations (3), can (3), guide (3), byte (2), performs (2), bitwise (2), 0x12 (2), var (2), http_header (2), length (2), nocase (2), decimal (2), multiplies (2), content_length (2), then (2), will (2), either (2), specified (2), math (2), pick (2), format (2), rpc (2), little (2), cursor (2), start (2), operator (2), into (2), 65535 (2), not (2), new (2), variables (2), payload (2), service (2), file (2), basics (2), abcd, despite, odd, ordering, single, previous, match, adds, immediately, after, they, exist, uses, resulting, examples, right, shifted, bits, equal, trailing, zeros, mask, between, less, than, executing, 0x01, 0xffffffff, before, octal, hexadecimal, stored, inspector, engine, determine, endianness, set, specify, whether, process, data, processed, default, instead, store, 4294967295, processing, description, performed, unsigned, bit, should, taken, consideration, when, avoid, integer, wrap, arounds, move, forward, does, there, also, few, additional, optional, listed, described, below, formatting, section, declared, keyword, colon, character, five, required, separated, commas, receive, final, existing, outcome, these, referenced, later, same, places, dark, light, snortml, hexdump, lua, shared, object, miscellaneous, information, tag, replace, detection_filter, post, stream_size, stream_reassemble, icmp_seq, icmp_id, icode, itype, window, ack, seq, file_type, flowbits, flow, flags, ip_proto, fragbits, ipopts, tos, ttl, fragoffset, non, s7commplus, modbus, mms, iec, 104, cip, dnp3, gtp, md5, sha256, sha512, cvs, sd_pattern, sip, ssl_state, ssl_version, ber_data, ber_skip, byte_jump, base64_decode, base64_data, vba_data, js_data, file_data, raw_data, pkt_data, regex, pcre, dsize, isdataat, bufferlen, combining, request, response, http_trailer_test, http_header_test, http_num_cookies, http_num_trailers, http_num_headers, http_max_trailer_line, http_max_header_line, http_version_match, http_true_ip, http_trailer, http_raw_trailer, http_raw_request, http_raw_status, http_stat_msg, http_stat_code, http_version, http_method, http_param, http_client_body, http_raw_body, http_cookie, http_raw_cookie, http_raw_header, http_uri, http_raw_uri, http, depth, distance, within, width, fast_pattern, file_meta, rem, metadata, priority, classtype, rev, sid, gid, reference, msg, general, syntax, key, identification, types, direction, operators, port, numbers, addresses, protocols, actions, headers, alert, logging, trace, modules, tweaks, scripts, wizard, binder, configuration, reading, traffic, command, line, installing, getting, started, introduction,

Text of the page (random words):
byte_math snort 3 rule writing guide snort 3 rule writing guide introduction using snort 3 getting started with snort 3 installing snort using snort command line basics reading traffic configuration rules wizard and binder tweaks and scripts trace modules alert logging writing snort rules the basics rule headers rule actions protocols ip addresses port numbers direction operators new rule types service rules file rules file identification rules rule options rule option syntax key general rule options msg reference gid sid rev classtype priority metadata service rem file_meta payload detection rule options content fast_pattern nocase width and endian offset depth distance and within http specific options http_uri and http_raw_uri http_header and http_raw_header http_cookie and http_raw_cookie http_client_body and http_raw_body http_param http_method http_version http_stat_code http_stat_msg http_raw_request and http_raw_status http_trailer and http_raw_trailer http_true_ip http_version_match http_max_header_line http_max_trailer_line http_num_headers http_num_trailers http_num_cookies http_header_test http_trailer_test combining request and response detection bufferlen isdataat dsize pcre regex pkt_data raw_data file_data js_data vba_data base64_decode and base64_data byte_extract byte_test byte_math byte_jump ber_data and ber_skip ssl_state and ssl_version dce specific options sip specific options sd_pattern cvs md5 sha256 and sha512 gtp specific options dnp3 specific options cip specific options iec 104 specific options mms specific options modbus specific options s7commplus specific options non payload detection rule options fragoffset ttl tos id ipopts fragbits ip_proto flags flow flowbits file_type seq ack window itype icode icmp_id icmp_seq rpc stream_reassemble stream_size post detection rule options detection_filter replace tag miscellaneous information shared object rules hexdump lua snortml snort light snort dark snort 3 rule writing guide byte_math the byte_math operation extracts bytes from the packet performs a mathematical operation on the extracted value with specified value or existing variable and stores the outcome in a new variable these variables can be referenced later in the rule in the same places that byte_extract variables can be used byte_math is declared with the keyword followed by a colon character followed by five required arguments separated by commas 1 bytes followed by the number of bytes to extract from the packet 2 offset followed by the offset of the bytes to extract 3 oper followed by the mathematical operation to perform on the extracted value 4 rvalue followed by the value to use with the mathematical operation on the extracted value and 5 result followed by the name of variable that will receive the final result there are also a few additional optional arguments that are listed and described below in the formatting section valid math operations that can be used in this option include and note the byte_math option does not move the detection cursor forward note byte_math operations are performed on unsigned 32 bit values and this should be taken into consideration when writing rules to avoid integer wrap arounds format byte_math bytes count offset offset oper operator rvalue rvalue result result relative endian endian string dec hex oct dce bitmask bitmask argument description count number of bytes to pick up from the buffer valid values include 1 10 if string argument is used and 1 4 if string argument is not used offset variable name or number of bytes into the buffer to start processing valid values include valid values include 65535 65535 operator mathematical operation to perform on the extracted value valid operations include and rvalue value to use the mathematical operation with the extracted bytes valid values include 1 4294967295 or an extracted byte_extract variable result name of the variable to store the result in relative offset relative from cursor instead of start of buffer endian endian set to either big or little to specify whether to process the data as little endian or big endian packet bytes are processed as big endian by default dce use the dce rpc 2 inspector engine to determine the byte endianness string pick up bytes from packet that are stored in string format must be followed by hex oct or dec hex extract the string bytes in the packet from a hexadecimal string must be accompanied by string oct extract the string bytes in the packet from an octal string must be accompanied by string dec extract the string bytes in the packet from a decimal string must be accompanied by string bitmask bitmask perform an and bitwise operation with the specified bitmask on the extracted bytes before executing the math operation valid values are 0x01 0xffffffff note if using either the or operation then 1 the count value must be between 1 and 4 bytes and 2 the rvalue must be less than 32 note the bitmask argument result will be right shifted by the number of bits equal to the number of trailing zeros in the mask examples extracts 2 bytes at offset 0 multiplies the extracted number by 10 and stores the result in the variable area and then uses the resulting variable in a byte_test option byte_math bytes 2 offset 0 oper rvalue 10 result area byte_test 2 area 16 http_header content content length nocase extracts 8 decimal string bytes immediately after content length if they exist multiplies the value by 10 and stores the result in content_length byte_math bytes 8 offset 0 oper rvalue 10 result content_length relative string dec content abcd this is a valid byte_math option despite the odd ordering of the arguments extracts a single byte 10 bytes from the previous match adds 10 to it performs on it a bitwise and with 0x12 and stores the result in var byte_math oper rvalue 10 offset 10 result var bytes 1 bitmask 0x12 relative