From: Jeff Lucovsky Date: Sun, 15 Dec 2019 19:44:07 +0000 (-0500) Subject: doc: Update byte_test documentation X-Git-Tag: suricata-6.0.0-beta1~609 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bc01392e93ffba5b5b0ceee2fad20a92e3564089;p=thirdparty%2Fsuricata.git doc: Update byte_test documentation --- diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst index ad4e5814af..ca4f6eeb6c 100644 --- a/doc/userguide/rules/payload-keywords.rst +++ b/doc/userguide/rules/payload-keywords.rst @@ -299,7 +299,11 @@ Example of dsize in a rule: byte_test --------- -The ``byte_test`` keyword extracts ```` and performs an operation selected with ```` against the value in ```` at a particular ````. +The ``byte_test`` keyword extracts ```` and performs an operation selected +with ```` against the value in ```` at a particular ````. +The ```` is applied to the extracted bytes (before the operator is applied), +and the final result will be right shifted one bit for each trailing ``0`` in +the ````. Format::