Key Pages: [ Rope Home Page | Basics (tutorial) | Language Reference | Download ]
The "expect" action takes a specified number of bytes from the packet being inspected, starting at $offset. The lifted bytes are returned as a string and $offset is advanced to point to the next byte in the packet.
If there are fewer than the requested number of bytes available, expect returns a "no" status to NetFilter, indicating that the packet being inspected does not match.
The "lift" action is similar, but handles the end-of-packet differently
For example..
expect(4) 4 expect
Lowth.com: [ Home | Rope | P2PWall | LinWiz | cutter | Protector - Free Antivirus software | TapeIO ]