UASL( .id = 2; .pattern = "ABC"; .at = 0; .pattern = "XYZ"; .distance = 3, match; .startin = 1, match; )
A sequential search for two patterns is performed:
-
Search for the beginning of the ABC template from the beginning of the packet (.at=0;).
-
After skipping 3bytes from the last found ABC template (.distance=3,match;), search for the beginning of the XYZ template is performed; for the pattern to be triggered, the beginning of the XYZ template should match the first byte from which the search starts, because .startin=1,match;.