This is wonderful. Then I want to do through byte_extract, byte_math.
alert tcp any any -> any 44818 (msg:"Alert PLC Allen Bradley"; byte_extract:1,46,len,string,dec; byte_math:bytes 1,offset 47,oper +,rvalue len,result var,string dec; content:"|20 6b|"; offset:47; depth:var; sid:10001; rev:1;)
In the first option, I get the value of the Request Path Size byte and write it to “len”. With the second option, I take the same byte and add “len” to it, writing the result to “var”. Next I use depth:var. This does not cause errors, but it does not detect the package I need (1 dump). Why?