byte_jump, byte_test
Use the byte_jump keyword to move the reference point. The distance to be skipped is calculated from the value of bytes at a specified offset.
Use the byte_test keyword to compare the value of bytes at the specified offset with a given value. The keyword does not move the reference point.
If the data to be processed or skipped is beyond the end of the packet, the option is considered unmatched.
Syntax:
--byte_jump <”|bytes>,<offset|variable>[,<multiplier>[,modifiers]];
--byte_test <”|bytes>,<op>,<value>,<offset>[,<multiplier>[,modifiers]];
|
<field> |
Description |
||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
Specifies the number of bytes from the payload to be converted. The value to be converted can be an ASCII string or binary. If the value is in binary, select between 1,2, or 4 bytes to be converted. If the value is an ASCII string, use the |
||||||||||||||||
|
|
Defines the operator used to compare the value converted from the packet with the value specified. The following operators are accepted:
|
||||||||||||||||
|
|
This is only used to match content in the URI field of an HTTP request. Specifies the value to be compared. A hexadecimal number can be specified with the prefix 0x. This also accepts variables and arithmetic operations (+ * /). The following predefined variable is accepted:
|
||||||||||||||||
|
|
Specifies the starting point where the content should be converted in the payload. Negative offsets are accepted. See the |
||||||||||||||||
|
|
Optional. It must be a numerical value when present. The converted value multiplied by this number is the result to be compared or skipped. |
||||||||||||||||
|
|
Accepts a combination (separated by commas) of the following values:
|
Examples:
--byte_jump 4,0,relative;
--byte_test 4,>,3536,0,relative;
--byte_jump 4,20,relative,align;
--byte_jump 4,0,4,relative,little;
--byte_test 4,>,0x7FFF,4,relative;
--byte_ttest 4,>,$PKT_SIZE,4,relative;
--byte_test 4,>,$PKT_SIZE,4,2,relative;