The **isdataat** keyword is used to check whether data exists in a specified position. If data exists, the rule is matched. The data following **isdataat** can be modified using an exclamation mark (!), which indicates that no data exists in the position. If data does not exist, the rule is matched.

The **isdataat** keyword can be modified by **relative**.When the **isdataat** keyword is modified by **relative** indicates a relative position, specifying the number of offset bytes after the end position of the previous matching. When **isdatatat** and **relative** are used together, use a comma (<font color = red>**,**</font>) to separate them.

Example:

> PAYLOAD:
>
> <font color = green>ABCD</font>EFGHIJKLMN

Matching conditions:

```
content: "ABCD";　isdataat:12;            Matched (Data exists in the M position.)
content: "ABCD";　isdataat:!15;           
  Matched (No data exists after an offset of 15 bytes from PAYLOAD.)
content: "ABCD";　isdataat:12, relative;  
  Not matched (No data exists after an offset of 12 bytes from D.)
content: "ABCD";　isdataat:8, relative;   Matched
```

isdataat and relative Keywords