diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst index c552e91923..1b12c088e3 100644 --- a/doc/userguide/rules/payload-keywords.rst +++ b/doc/userguide/rules/payload-keywords.rst @@ -439,7 +439,37 @@ The ``byte_extract`` keyword extracts ```` at a particular ``, , , [, relative]; + byte_extract:, , , [,relative] [,multiplier ] \ + [,] [, dce] [, string [, ] [, align | The number of bytes selected from the packet to be extracted | ++--------------------+--------------------------------------------------------------------------+ +| | Number of bytes into the payload | ++--------------------+--------------------------------------------------------------------------+ +| | The name of the variable in which to store the value | ++--------------------+--------------------------------------------------------------------------+ +| [relative] | Offset relative to last content match | ++--------------------+--------------------------------------------------------------------------+ +| multiplier | multiply the extracted bytes by before storing | ++--------------------+--------------------------------------------------------------------------+ +| [endian] | Type of number being read: | +| | - big (Most significant byte at lowest address) | +| | - little (Most significant byte at the highest address) | ++--------------------+--------------------------------------------------------------------------+ +| [string] | | +| | - hex - Converted string represented in hex | +| | - dec - Converted string represented in decimal | +| | - oct - Converted string represented in octal | ++--------------------+--------------------------------------------------------------------------+ +| [dce] | Allow the DCE module determine the byte order | ++--------------------+--------------------------------------------------------------------------+ +| align | Round the extracted value up to the next | +| | next byte boundary post-multiplication (if any) | +| | ; may be 2 or 4 | ++--------------------+--------------------------------------------------------------------------+ + ============== ================================== Keyword Modifier