diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst index bb64b1681e..4b0db2cfca 100644 --- a/doc/userguide/rules/payload-keywords.rst +++ b/doc/userguide/rules/payload-keywords.rst @@ -569,6 +569,8 @@ When ``relative`` is included, there must be a previous ``content`` or ``pcre`` Note: if ``oper`` is ``/`` and the divisor is 0, there will never be a match on the ``byte_math`` keyword. +Note: if ``oper`` is ``<<`` or ``>>`` and ``rvalue`` is 64 or greater, the result is 0. + The result can be stored in a result variable and referenced by other rule options later in the rule.