depth Keyword
If the feature string matching is expected to be performed only within a certain number of bytes, the **depth** keyword can be used to modify **content**. Example: > GET **<u><font color="blue">/page1</font></u>**.html HTTP/1.1 > > ↑-----↑ depth = 6 Matching conditions: ``` content: "page1"; http_uri; depth:6; Matched content: "html"; http_uri; depth:6; Not matched ``` The two rules match 6 bytes from the beginning of the field (starting from the start position of the URI, that is, offset = 0) to check whether the **page1** and **html** fields exist. The **depth** modifier is often used with the **offset** modifier. Example: > GET /page1.**<font color ="red">h</font><font color ="blue">tml</font>** HTTP/1.1 > > ↑ offset = 7 > > ↑---↑ depth = 4 Matching conditions: ``` content: "html"; http_uri; offset:7; depth:4; Matched ```