fragoffset

The fragoffset rule option is used to check that the IP fragment offset value in the IP header is less than, greater than, equal to, not equal to, less than or equal to, or greater than or equal to a specified integer value. This rule option can also check that the header's fragment's offset value is between a range of numbers, using the <> range operator for an exclusive range check or the <=> for an inclusive one.

Format:

Single value comparison:

fragoffset:[<|>|=|!|<=|>=]fragoffset;

Range comparison:

fragoffset:fragoffset_min{<>|<=>}fragoffset_max;

Examples:

# Check that the fragoffset equals 0
fragoffset:0;

# Check that the fragoffset does not equal 0
fragoffset:!0;