doc/byte_math: Add divide by 0 discussion.

Issue: 5945
(cherry picked from commit fd46c93a8f0f35375d349cf9402c2614dedff72b)

diff --git a/doc/userguide/rules/differences-from-snort.rst b/doc/userguide/rules/differences-from-snort.rst
index 1457f2c2ff152be77c47e5a476d75acb7259c173..ff24a7e1af8a6494d4205f7c448dc261111ef6c4 100644 (file)
--- a/doc/userguide/rules/differences-from-snort.rst
+++ b/doc/userguide/rules/differences-from-snort.rst
@@ -263,6 +263,12 @@ See :doc:`http-keywords` for all HTTP keywords.
    use ``byte_extract`` and ``byte_test`` to verify that they
    work as expected.
 
+``byte_math`` Keyword
+---------------------
+
+- Suricata will never match if there's a zero divisor. Division by 0 is undefined.
+
+
 ``isdataat`` Keyword
 --------------------
 

diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst
index 1a41ef9767d82e6751f5deae91673d055d1541a5..f4779901baaeeb7c7734f2808e544190beedc1b3 100644 (file)
--- a/doc/userguide/rules/payload-keywords.rst
+++ b/doc/userguide/rules/payload-keywords.rst
@@ -379,6 +379,8 @@ an existing variable or a specified value.
 
 When ``relative`` is included, there must be a previous ``content`` or ``pcre`` match.
 
+Note: if ``oper`` is ``/`` and the divisor is 0, there will never be a match on the ``byte_math`` keyword.
+
 The result can be stored in a result variable and referenced by
 other rule options later in the rule.