bit_slice(protocol String, offset_start Number, offset_end Number)Number
- This function looks for matches on a given slice of bits.
- The offset starts on the given protocol header. For example, to match on the first bit of payload for a UDP packet, you must set
offset_start to 64.
- This is primarily intended for use with
ip, udp, and tcp.
- The slice (
offset_end — offset_start) cannot be longer than 32 bits, but multiple calls can be joined together via logical expressions.
- The
bit_slice offset cannot exceed 2,040 bits.