Skip to content

Commit 244a35d

Browse files
jufajardinivictorjulien
authored andcommitted
userguide: fix explanation about bsize ranges
Our code handles Uint ranges as exclusive, but for bsize, our documentation stated that they're inclusive. Cf. from uint.rs: DetectUintMode::DetectUintModeRange => { if val > x.arg1 && val < x.arg2 { return true; } } Task #6708
1 parent b8bc2c7 commit 244a35d

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

‎doc/userguide/rules/payload-keywords.rst‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ bsize uses an :ref:`unsigned 64-bit integer <rules-integer-keywords>`.
284284

285285
An optional operator can be specified; if no operator is present, the operator will
286286
default to '='. When a relational operator is used, e.g., '<', '>' or '<>' (range),
287-
the bsize value will be compared using the relational operator. Ranges are inclusive.
287+
the bsize value will be compared using the relational operator. Ranges are exclusive.
288288

289289
If one or more ``content`` keywords precedes ``bsize``, each occurrence of ``content``
290290
will be inspected and an error will be raised if the content length and the bsize
@@ -327,6 +327,9 @@ Examples of ``bsize`` in a rule:
327327

328328
alert dns any any -> any any (msg:"test bsize rule"; dns.query; content:"middle"; bsize:6<>15; sid:126; rev:1;)
329329

330+
To emphasize how range works: in the example above, a match will occur if
331+
``bsize`` is greater than 6 and less than 15.
332+
330333
dsize
331334
-----
332335

0 commit comments

Comments
 (0)