Thanks, Victor. I would have a hardcoded value in the rule, and would like to alert when $byte_count is less than or greater to that hardcoded value. Since $byte_count could be different in every packet, it would need to be determined dynamically and compared against the hardcoded value.