title: Snort rules for byte code
body: <p>I just started to learn how to use Snort today. </p>
  
  <p>However, I need a bit of help with my rules setup. </p>
  
  <p>I am trying to look for the following code on the network sent to a machine. This machine has snort installed on it (as I installed it now). </p>
  
  <p>The code I want to analyze on the network is in bytes. </p>
  
  <pre><code>\xAA\x00\x00\x00\x00\x00\x00\x0F\x00\x00\x02\x74\x00\x00' (total of 14 bytes)
  </code></pre>
  
  <p>Now, I am looking at wanting to analyze the first 7 bytes of the code. For me if the 1st byte is <code>(AA)</code> and 7th byte is <code>(0F)</code>. Then I want snort to set off an alarm.</p>
  
  <p>So far my rules are:</p>
  
  <pre><code>alert tcp any any -&gt; any any \
  (content:"|aa 00 00 00 00 00 00 0f|"; msg:"break in attempt"; sid:10; rev:1; \
  classtype:shellcode-detect; rawbytes;)
  byte_test:1, =, aa, 0, relative;
  byte_test:7 =, 0f, 7, relative;
  </code></pre>
  
  <p>I'm guessing I obviously have made a mistake somewhere. Maybe someone that is familair with snort could help me out? </p>
  
  <p>Thanks. </p>