[Snort-sigs] What is the & operator in byte_test for?

Matt Kettler mkettler at ...189...
Mon Aug 2 15:07:04 EDT 2004

At 05:30 PM 7/29/2004, Jeff Dell wrote:
>There is also an undocumented operator for bitwise OR that is the ^

The C programmer in me cringes at this :) I'd have assumed ^ to be XOR 

Actually, looking at the source code, it IS an XOR not an OR operator, 
despite the name of the #define being BT_OR.

          case '^': idx->operator = BT_OR;

         case BT_OR: if ((value ^ btd->cmp_value) > 0)

The second bit is the actual implementation, and it's using ^ as a C 
operator, which is bitwise-XOR.

More information about the Snort-sigs mailing list