From a006b371059d826a6d11864c6726f002d957ffc9 Mon Sep 17 00:00:00 2001 From: Sage S Date: Tue, 29 Sep 2026 13:06:12 -0600 Subject: [PATCH] doc: document valid nbytes ranges for byte_math Suricata enforces 1-10 bytes when the string option is used and 1-4 bytes otherwise (DetectByteMathValidateNbytesOnly). Ticket: https://redmine.openinfosecfoundation.org/issues/8236 --- doc/userguide/rules/payload-keywords.rst | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst index bb64b1681e..0c15304024 100644 --- a/doc/userguide/rules/payload-keywords.rst +++ b/doc/userguide/rules/payload-keywords.rst @@ -590,8 +590,9 @@ Format:: +-----------------------+-----------------------------------------------------------------------+ -| | The number of bytes selected from the packet | -| | or the name of a byte_extract variable. | +| | The number of bytes selected from the packet or the name of a | +| | byte_extract variable. | +| | Valid values: 1-10 when the ``string`` option is used, 1-4 otherwise. | +-----------------------+-----------------------------------------------------------------------+ | | Number of bytes into the payload | +-----------------------+-----------------------------------------------------------------------+