I have written the following rule in my Suricata rules file:
alert tcp any any <> any any (flow:established; content:"|65|"; offset:0; depth:1; byte_test:1, =, 3, 2, bitmask 0x03; msg:"detected"; classtype:bad-unknown; sid:222; rev:1; priority:1;)
But it shows the following error because of the
... [ERRCODE: SC_ERR_PCRE_PARSE(7)] - parse error, ret -1, string 1, =, 3, 2, bitmask 0x03 ...
I have found some examples in the Suricata documentation but none of them mention the way to properly use bitmask with the comparison operator.
My question is, what is the proper way to use the bitmask keyword? and why is it not working in the rule I have shown?