Add offset for protosig payload

Description

Would be nice to have an offset within the payload function. I'm about to make a git protosig and the actual text of "git-" 4 bytes in....would be great if you can add an offet when looking at content, for example:

{{signature protosig_git {
ip-proto == tcp
dst-port == 3418
tcp-state established
payload-offset == 4
payload /git-/
eval ProtoSig::match
}}}

I imagine the .* regex is pretty expensive processor-wise. Thank you.

Environment

None

Assignee

Unassigned

Reporter

jamesl

Labels

None

External issue ID

None

Components

Priority

Normal
Configure