dsize Syntax Rules
The **dsize** field is used to detect the payload size of a data packet. Example: ``` flow: to_server; content:"xget"; dsize:> 1000; ``` When the TCP/UDP Payload content matches the **xget** feature string and the payload length of the current packet is greater than 1000 bytes, the rule is matched. Supported operators | Keyword | Description | | ---------------- | --------------- | | dsize:1000; | Equal to | | dsize:>1000; | Greater than | | dsize:<1000; | Smaller than | | dsize:!1000; | Not equal to | | dsize:200<>1000; | Between 200 and 1000 |