doc: fix byte_test examples

As this keyword has 4 mandatory arguments, and some examples
had only three...

Ticket: 6629
(cherry picked from commit 4933b817aacc649edc52409426500a9ec271ccc6)

diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst
index 412f7b4fe0e4352087fc4b52f09f58c2f4a0275f..9a609a217f04205767cfa344103b8a257a837d86 100644 (file)
--- a/doc/userguide/rules/payload-keywords.rst
+++ b/doc/userguide/rules/payload-keywords.rst
@@ -412,23 +412,23 @@ Example::
 
   alert tcp any any -> any any \
         (msg:"Byte_Test Example - Num = Value"; \
-        content:"|00 01 00 02|"; byte_test:2,=,0x01;)
+        content:"|00 01 00 02|"; byte_test:2,=,0x01,0;)
 
   alert tcp any any -> any any \
         (msg:"Byte_Test Example - Num = Value relative to content"; \
-        content:"|00 01 00 02|"; byte_test:2,=,0x03,relative;)
+        content:"|00 01 00 02|"; byte_test:2,=,0x03,2,relative;)
 
   alert tcp any any -> any any \
         (msg:"Byte_Test Example - Num != Value"; content:"|00 01 00 02|"; \
-        byte_test:2,!=,0x06;)
+        byte_test:2,!=,0x06,0;)
 
   alert tcp any any -> any any \ 
          (msg:"Byte_Test Example - Detect Large Values"; content:"|00 01 00 02|"; \
-         byte_test:2,>,1000,relative;)
+         byte_test:2,>,1000,1,relative;)
 
   alert tcp any any -> any any \
         (msg:"Byte_Test Example - Lowest bit is set"; \
-        content:"|00 01 00 02|"; byte_test:2,&,0x01,relative;)
+        content:"|00 01 00 02|"; byte_test:2,&,0x01,12,relative;)
 
   alert tcp any any -> any any (msg:"Byte_Test Example - Compare to String"; \
         content:"foobar"; byte_test:4,=,1337,1,relative,string,dec;)