byte_extract Syntax Rules

**byte_extract** obtains data from the traffic, converts the data into an integer, and uses a variable name for the integer for future use.

Example:

```
content: "|11 94 00 F5|"; offset:4; depth:4; byte_extract: 2, 0, var_match, relative, bitmask 0x03ff; byte_test: 2, =, var_match, 2, relative;
```

After **|11 94 00 F5|** is matched, 2 bytes (after an offset of 0 bytes) are obtained and converted into a numeric value, and the mask is calculated to obtain A. Then A is assigned to **var_match**. After an offset of 2 bytes, a value is obtained to compare with **var_match**.

Syntax format:

```
byte_extract:<bytes_to_extract>, <offset>, <name> [, relative][, multiplier <multiplier value>][, <endian>][, string][, hex][, dec][, oct][, align <align value>][, bitmask <bitmask>];
```

Parameter description

| Parameter                 | Description                                                     |
| :------------------- | :----------------------------------------------------------- |
| bytes\_to\_convert     | Number of bytes obtained from the data packet. If data in the string format is obtained, the value is less than or equal to 10 and greater than 0. If the data is an integer, the value is smaller than 4 and greater than 0. |
| offset               | Offset of the bytes that start to be processed in the payload. The value ranges from -65535 to +65535.     |
| name                 | Variable name.                                                    |
| relative             | Offset relative to the previous feature string matching.                           |
| multiplier &#60;value&#62; | Multiplies the data. The multiplier is the value specified by **value**.                                  |
| big                  | Processes data in the network byte order (default).                               |
| little               | Processes data in the host byte order.                                       |
| string               | Sets the data in the data packet to be stored as a character string.                               |
| hex                  | Converts the character string data into a value in hexadecimal format.                             |
| dec                  | Converts the character string data into a value in decimal format.                                |
| oct                  | Converts the character string data into a value in octal format.                               |
| align                | During conversion, 4-byte alignment is performed. That is, the number of bytes to be converted is a multiple of 4. |
| bitmask              | Converts the data into a mask.                                                   |