Overview: The byte_jump and byte_test Keywords

You can use byte_jump and byte_test to calculate where in a packet the rules engine should begin testing for a data match, and which bytes it should evaluate.

You can also use the byte_jump and byte_test DCE/RPC argument to tailor these keywords for traffic processed by the DCE/RPC preprocessor. When you use the DCE/RPC argument, you can also use these keywords in conjunction with other specific DCE/RPC keywords.