Permitted Combinations: protected_content Search Location Arguments

Use the required Length protected_content location option in combination with either the Offset or Distance location option to specify where to begin searching for the specified content and how far to continue searching, as follows:

  • Use Length and Offset together to search for the protected string relative to the beginning of the packet payload.

  • Use Length and Distance together to search for the protected string relative to the current search location.

Tip

You cannot mix the Offset and Distance options within a single keyword configuration, but you can use any number of location options in a rule.

When no location is specified, the defaults are assumed; that is, the content search starts at the beginning of the packet payload and continues to the end of the packet.

You can also use an existing byte_extract variable to specify the value for a location option.