From 45a36e961fcfd5dfa23373d22d9e6b930297be3f Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Thu, 15 Jan 2026 10:09:10 -0500 Subject: [PATCH] doc/byte_jump: Clarify bitmask operation Issue: 6693 Clarify how the bitmask value is used for byte_jump Snort compatibility says: - The bitmask value is applied to the extracted value before the multiplier is applied. - The result of the bitmask operation is to be right shifted by the number of trailing 0's in the bitmask value. --- doc/userguide/rules/payload-keywords.rst | 2 ++ 1 file changed, 2 insertions(+) diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst index c3a59ee65c..25f74d853e 100644 --- a/doc/userguide/rules/payload-keywords.rst +++ b/doc/userguide/rules/payload-keywords.rst @@ -542,6 +542,8 @@ byte_jump --------- The ``byte_jump`` keyword allows for the ability to select a ```` from an ```` and moves the detection pointer to that position. Content matches will then be based off the new position. +The ``bitmask`` value is applied to the extracted value before the multiplier. Additionally, the result of the bitmask operation is +right-shifted by the number of trailing zeroes in the bitmask value. Format::