Actions
Documentation #6694
openplacement of bitmask note about right shift behavior
Affected Versions:
Effort:
Difficulty:
Label:
Description
byte_test has a snippet bout the right shift in the main keyword doc
https://docs.suricata.io/en/latest/rules/payload-keywords.html#byte-test
The <bitmask value> is applied to the extracted bytes (before the operator is applied), and the final result will be right shifted one bit for each trailing 0 in the <bitmask value>.
but byte_math and byte_jump has it in the table with a description of each keyword option.
i think byte_test should be updated to include the note in the table to match byte_math and byte_jump.
Actions