doc/byte_math: Add divide by 0 discussion.

Issue: 5945

diff --git a/doc/userguide/rules/differences-from-snort.rst b/doc/userguide/rules/differences-from-snort.rst
index 8226e3a7e89941383e62bf617cd024484694fea0..9638a25d08e61e1211e801ddc4ecbf65a78f14ce 100644 (file)
--- a/doc/userguide/rules/differences-from-snort.rst
+++ b/doc/userguide/rules/differences-from-snort.rst
@@ -276,6 +276,8 @@ See :doc:`http-keywords` for all HTTP keywords.
    uint32 value. Snort rejects ``rvalue`` values of ``0`` and requires
    values to be between ``[1..max-uint32 value]``.
 
+- Suricata will never match if there's a zero divisor. Division by 0 is undefined.
+
 
 ``isdataat`` Keyword
 --------------------

diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst
index 14f5092be0183e9c8704df345563324da82333b9..4342874f492a1f0880fab384d5895e7317e0227d 100644 (file)
--- a/doc/userguide/rules/payload-keywords.rst
+++ b/doc/userguide/rules/payload-keywords.rst
@@ -441,6 +441,8 @@ an existing variable or a specified value.
 
 When ``relative`` is included, there must be a previous ``content`` or ``pcre`` match.
 
+Note: if ``oper`` is ``/`` and the divisor is 0, there will never be a match on the ``byte_math`` keyword.
+
 The result can be stored in a result variable and referenced by
 other rule options later in the rule.