The NoBlockSplit condition is only applicable within TcpRuleRecvProto and TcpRuleRecvUntil rules.
It uses the attributes ApplyTo, Offset, Length, UseDataAvail and IfNull to determine what data is to be subject to the test and what the return value should be if the data isn't available.
Also see section “Specifying Data for Conditions”.
In contrast to other conditions, the default value for the ApplyTo attribute is All, rather than Self.
When recording TCP/IP traffic, servers may send responses in multiple TCP/IP packets (blocks). The NoBlockSplit condition tests to see if the end of the data obtained by ApplyTo, Offset and Length is identical to the end of one of the packets.
The result is false if the end of the tested data is not on a block boundary; otherwise the result is true.
<NoBlockSplit></NoBlockSplit> <NoBlockSplit> <ApplyTo>Left<ApplyTo> </NoBlockSplit>