# Don't understand how work byte\_jump with variable from byte\_extract **URL:** \ **Category:** Rules\ **Tags:** rules, suricata\ **Created:** [August 22, 2025, 7:03am UTC](https://forum.suricata.io/t/dont-understand-how-work-byte-jump-with-variable-from-byte-extract/5968 "2025-08-22T07:03:15Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![SamFreeman](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/samfreeman/32/3689_2.png) [@SamFreeman](https://forum.suricata.io/u/SamFreeman)\ **Post date:** [August 22, 2025, 7:03am UTC](https://forum.suricata.io/t/dont-understand-how-work-byte-jump-with-variable-from-byte-extract/5968/1 "2025-08-22T07:03:15Z")
Hi everybody. frame 8. I need to find |be 01| this is the OpenSecureChanel ID, namely 446. “SecurityPolicyUri” is shown in green at number 2. These data have different lengths. they can reach up to 4096 bytes. There are 4 bytes(red light (1)) in front of “SecurityPolicyUri”, which indicate the length of “SecurityPolicyUri”. Since the length is constantly changing, I need to skip this number of bytes. + after “SecurityPolicyUri” skip 18 bytes (blue) and find the sequence |be 01|.|be 01| in hexadecimal format -Decimal: 48641 (big-endian)|01 be| in hexadecimal form - In decimal system: 446 (little-endian) I wrote this rule:alert tcp any any → any any (msg:“OPCUa TEST”; flow:established,to\_server; byte\_extract:4,12,len\_of\_policy\_uri,little; byte\_jump:len\_of\_policy\_uri,16,from\_beginning,little,string,dec,post\_offset 18; content:“|be 01|”; sid:7000452; rev:8;)This rule no alert. It is written correctly, there is no mistake in it. I wanted to extract 4 bytes at shift 12 and put it in a variable. BUT I need it in little-endian, and in big-endian traffic. Made byte\_extract:byte\_extract:4,12,len\_of\_policy\_uri,little;next byte jump:byte\_jump:len\_of\_policy\_uri,16,from\_beginning,little,string,dec,post\_offset 18;I also left little endian, and so that the len\_of\_policy\_uri variable is counted in decimal. But it doesn’t work! I can’t figure out if I’m putting the endians correctly or if everything counts correctly. HELP ME, PLEASE tcp payload: 0000 4f 50 4e 46 85 00 00 00 00 00 00 00 2f 00 00 00 OPNF···· ····/··· 0010 68 74 74 70 3a 2f 2f 6f 70 63 66 6f 75 6e 64 61 [http://o](http://o) pcfounda 0020 74 69 6f 6e 2e 6f 72 67 2f 55 41 2f 53 65 63 75 [tion.org](http://tion.org) /UA/Secu 0030 72 69 74 79 50 6f 6c 69 63 79 23 4e 6f 6e 65 ff rityPoli cy#None· 0040 ff ff ff ff ff ff ff 01 00 00 00 01 00 00 00 01 ········ ········ 0050 00 be 01 00 00 64 98 38 5c 4d 0a d9 01 00 00 00 ·····d·8 \M······ 0060 00 00 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 ········ ········ 0070 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 ········ ········ 0080 00 e0 43 04 00 ··C·· ![photo_2025-08-21_17-14-20](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/b/b75efe06a24bd1f8c628cf60ae11d437a6cfd42a.jpeg) ---
**Author:** ![SamFreeman](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/samfreeman/32/3689_2.png) [@SamFreeman](https://forum.suricata.io/u/SamFreeman)\ **Post date:** [August 22, 2025, 7:12am UTC](https://forum.suricata.io/t/dont-understand-how-work-byte-jump-with-variable-from-byte-extract/5968/2 "2025-08-22T07:12:26Z")
sorry, i forgot i use suricata 8.0 ---
**Author:** ![SamFreeman](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/samfreeman/32/3689_2.png) [@SamFreeman](https://forum.suricata.io/u/SamFreeman)\ **Post date:** [August 22, 2025, 12:18pm UTC](https://forum.suricata.io/t/dont-understand-how-work-byte-jump-with-variable-from-byte-extract/5968/3 "2025-08-22T12:18:07Z")
i did it! workable rule: alert tcp any any → any any (msg:“OPCUa TEST”; flow:established,to\_server; content:“|4f 50 4e|”; fast\_pattern; offset:0; depth:3; byte\_math:bytes 4,offset 12,oper +,rvalue 34,result offset\_math,endian little; content: “|be 01|”; offset:offset\_math; depth:2; sid:7000452;rev:7;) Might be useful to someone…. 0000 4f 50 4e 46 85 00 00 00 00 00 00 00 2f 00 00 00 OPNF…/… 0010 68 74 74 70 3a 2f 2f 6f 70 63 66 6f 75 6e 64 61 [http://opcfounda](http://opcfounda) 0020 74 69 6f 6e 2e 6f 72 67 2f 55 41 2f 53 65 63 75 [tion.org/UA/Secu](http://tion.org/UA/Secu) 0030 72 69 74 79 50 6f 6c 69 63 79 23 4e 6f 6e 65 ff rityPolicy#None. 0040 ff ff ff ff ff ff ff 01 00 00 00 01 00 00 00 01 … 0050 00 be 01 00 00 64 98 38 5c 4d 0a d9 01 00 00 00 …d.8\M… 0060 00 00 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 … 0070 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 … 0080 00 e0 43 04 00 ..C.. content:“|4f 50 4e|” - OPN byte\_math:bytes 4,offset 12,oper +,rvalue 34,result offset\_math,endian little; let’s take it step by step - bytes 4,offset 12 it’s 2f 00 00 00 - endian little it mean that 2f 00 00 00 convert to 00 00 00 2f (big endian - little endian). 00 00 00 2f = 47 in decimal. length of security policy uri - oper +,rvalue 34 it mean that we 47 + 34 = 81. why 34? because “4f 50 4e 46 85 00 00 00 00 00 00 00 2f 00 00 00“ + “ff ff ff ff ff ff ff ff 01 00 00 00 01 00 00 00 01 00“ - result offset\_math No need to explain)) and we take offset\_math to offset and find content |be 01|