**byte_math** obtains data from the traffic, converts the data into an integer, calculates the integer value based on **rvalue**, and assigns a variable name to the integer value for future use.

Example:

```
(byte_extract: 4, 3, extracted_val, relative; byte_math: bytes 5, offset 0, oper +, rvalue extracted_val, result var, string hex; byte_test:5, =, var, 4, string, hex;
```

4 bytes after an offset of 3 bytes are converted into an integer, and the integer is assigned to **extracted_val**. A 5-byte hexadecimal character string is obtained and converted into an integer, which pluses **extracted_val** to obtain a new value. Then the new value is assigned to **var**. A 5-byte hexadecimal character string after an offset of 4 bytes is obtained and converted into an integer for comparison with **var**. If they are the same, the rule is matched.

Syntax format:

```
byte_math:bytes <bytes_to_extract>, offset <offset_value>, oper <operator>,rvalue <r_value>, result <result_variable> [, relative][, endian <endian>] [, string <number type>][, bitmask <bitmask_value>];
```

| Parameter             | Description                                                     |
| :--------------- | :----------------------------------------------------------- |
| bytes\_to\_convert | Number of bytes obtained from the data packet. If data in the string format is obtained, the value is less than or equal to 10 and greater than 0. If the data is an integer, the value is smaller than 4 and greater than 0. |
| operator         | Operation performed on the detection. The following operators are supported:  +, -, *, /, «, and ».         |
| rvalue           | Value used to compare with the converted value. The value ranges from 0 to 4294967295.             |
 | offset           | Offset of the bytes that start to be processed in the payload. The value ranges from -65535 to +65535.     |
| result\_variable  | Variable name. Variable usage range: value and offset fields of byte\_test; offset of byte\_jump; offset and r\_value of byte_math.|
| relative         | Offset relative to the previous feature string matching.                           |
| big              | Processes data in the network byte order (default).                               |
| little           | Processes data in the host byte order.                                       |
| string           | Sets the data in the data packet to be stored as a character string.                               |
| hex              | Converts the character string data into a value in hexadecimal format.                             |
| dec              | Converts the character string data into a value in decimal format.                                |
| oct              | Converts the character string data into a value in octal format.                               |
| bitmask          | Converts the data into a mask.                                                   |

byte_math Syntax Rules