TcpRuleRecvProto

The TcpRuleRecvProto rule type describes protocols with the following basic structure:

The number of bytes to be received can be extracted from the protocol header at offset LengthOffset using LengthLen number of bytes. This can be interpreted either in big endian or little endian representation. Additionally, the obtained value may be multiplied by a value (attribute LengthFactor), and/or a constant value may be added (attribute LengthAdd).