diff --git a/doc/snort_manual.tex b/doc/snort_manual.tex
index 23111c0..e7ce452 100644
--- a/doc/snort_manual.tex
+++ b/doc/snort_manual.tex
@@ -7961,11 +7961,12 @@ normal \texttt{byte\_test} arguments will not be allowed: \texttt{big},
 \item[] \textit{Syntax}
 \footnotesize
 \begin{verbatim}
-    byte_jump:<convert>, <offset>[, relative][, multiplier <mult_value>] \
-        [, align][, post_offet <adjustment_value>], dce;
+    byte_jump:<convert>, <offset>[, relative][, mask <mask_value>] \
+        [, multiplier <mult_value>][, align][, post_offet <adjustment_value>], dce;
 
     convert           = 1 | 2 | 4 (only with option "dce")
     offset            = -65535 to 65535
+    mask_value        = 0x00000000 to 0xffffffff
     mult_value        = 0 - 65535
     adjustment_value  = -65535 to 65535
 \end{verbatim}
@@ -15469,7 +15470,7 @@ used without \texttt{dce}. If used with \texttt{dce} allowed values are 1, 2 and
 \item \textgreater{} - greater than
 \item = - equal
 \item \& - bitwise AND
-\item \textasciicircum{} - bitwise OR
+\item \textasciicircum{} - bitwise XOR
 \end{itemize}\\
 \hline
 \texttt{value} & Value to test the converted value against\\
@@ -15572,13 +15573,15 @@ values}.
 
 \begin{verbatim}
     byte_jump:<bytes_to_convert>, <offset> \
-        [, relative][, multiplier <mult_value>][, <endian>][, string, <number_type>]\
-        [, align][, from_beginning][, post_offset <adjustment value>][, dce];
+        [, relative][, mask <mask_value>][, multiplier <multiplier_value>][, <endian>]\
+        [, string, <number_type>][, align][, from_beginning]\
+        [, post_offset <adjustment value>][, dce];
 
-    bytes       = 1 - 10
-    offset      = -65535 to 65535
-    mult_value  = 0 - 65535
-    post_offset = -65535 to 65535
+    bytes             = 1 - 10
+    offset            = -65535 to 65535
+    mask_value        = 0x00000000 to 0xffffffff
+    multiplier_value  = 0 - 65535
+    post_offset       = -65535 to 65535
     
 \end{verbatim}
 
@@ -15597,8 +15600,10 @@ used without \texttt{dce}. If used with \texttt{dce} allowed values are 1, 2 and
 \hline
 \texttt{relative} & Use an offset relative to last pattern match\\
 \hline
-\texttt{multiplier $<$value$>$} & Multiply the number of calculated bytes by
-\texttt{$<$value$>$} and skip forward that number of bytes.\\
+\texttt{mask $<$mask\_value$>$} & Bitwise AND the number of calculated bytes by \texttt{$<$mask\_value$>$}.\\
+\hline
+\texttt{multiplier $<$multiplier\_value$>$} & Multiply the number of calculated bytes by
+\texttt{$<$multiplier\_value$>$} and skip forward that number of bytes.\\
 \hline
 \texttt{big} & Process data as big endian (default)\\
 \hline
@@ -15655,8 +15660,13 @@ re-used in the same rule any number of times.
 
 \begin{verbatim}
     byte_extract:<bytes_to_extract>, <offset>, <name> \
-        [, relative][, multiplier <multiplier value>][, <endian>]\ 
-        [, string][, hex][, dec][, oct][, align <align value>][, dce]
+        [, relative][, multiplier <multiplier value>][,mask <mask_value>]\
+        [, <endian>][, string, <number_type>][, align <align value>][, dce]
+
+    bytes             = 1 - 4
+    offset            = -65535 to 65535
+    mask_value        = 0x00000000 to 0xffffffff
+    multiplier_value = 0 - 65535
 \end{verbatim}
 
 \begin{tabular}{| l | p{4.5in} |}
@@ -15664,7 +15674,7 @@ re-used in the same rule any number of times.
 {\bf Option} & {\bf Description}\\
 \hline
 \hline
-\texttt{bytes\_to\_convert} & Number of bytes to pick up from the packet\\
+\texttt{bytes\_to\_convert} & Number of bytes to pick up from the packet. The allowed values are 1 to 4.\\
 \hline
 \texttt{offset} & Number of bytes into the payload to start processing\\
 \hline
@@ -15673,6 +15683,8 @@ variable in other rule options.\\
 \hline
 \texttt{relative} & Use an offset relative to last pattern match\\
 \hline
+\texttt{mask $<$mask\_value$>$} & Bitwise AND the number of calculated bytes by \texttt{$<$mask\_value$>$}.\\
+\hline
 \texttt{multiplier $<$value$>$} & Multiply the bytes read from the packet by
 \texttt{$<$value$>$} and save that number into the variable.\\
 \hline
diff --git a/src/detection-plugins/sp_byte_extract.c b/src/detection-plugins/sp_byte_extract.c
index 8efacf6..096a7f0 100644
--- a/src/detection-plugins/sp_byte_extract.c
+++ b/src/detection-plugins/sp_byte_extract.c
@@ -20,7 +20,38 @@
 
 /* sp_byte_extract
  *
- * Description goes here. Snort rule interface for byte_extract functionality.
+ * Purpose:
+ *      Grab some number of bytes, convert them to their numeric
+ *      representation, and store as a named variable for later use in
+ *      the same rule.
+ *
+ * Arguments:
+ *      Required:
+ *      <bytes_to_extract>: number of bytes to pick up from the packet
+ *      <offset>: number of bytes into the payload to grab the bytes
+ *      <name>: name of the variable to store the extracted bytes in
+ *      Optional:
+ *      ["relative"]: offset relative to last pattern match
+ *      ["mask"]: bitmask to apply to the extracted bytes (bitwise AND)
+ *      ["multiplier"]: value to multiply extracted bytes by
+ *      ["big"]: process data as big endian (default)
+ *      ["little"]: process data as little endian
+ *      ["string"]: converted bytes represented as a string needing conversion
+ *      ["hex"]: converted string data is represented in hexidecimal
+ *      ["dec"]: converted string data is represented in decimal
+ *      ["oct"]: converted string data is represented in octal
+ *      ["align"]: round the number of converted bytes up to the next
+ *                 32-bit boundry
+ *
+ *   sample rules:
+ *   alert tcp any any -> any any (byte_extract:1, 0, str_offset; \
+ *       byte_extract:1, 1, str_depth; \
+ *       content:"bad stuff"; offset:str_offset; depth:str_depth; \
+ *       msg:"Bad Stuff detected within field";)
+ *
+ * Comments:
+ *
+ * Any comments?
  *
  */
 
@@ -88,12 +119,13 @@ void PrintByteExtract(ByteExtractData *data)
 
     DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,
            "bytes_to_grab = %d, offset = %d, relative = %d, convert = %d, "
-           "align = %d, endianess = %d, base = %d, "
+           "mask = %d, align = %d, align = %d, endianess = %d, base = %d, "
            "multiplier = %d, var_num = %d, name = %s\n",
            data->bytes_to_grab,
            data->offset,
            data->relative_flag,
            data->data_string_convert_flag,
+           data->mask,
            data->align,
            data->endianess,
            data->base,
@@ -139,6 +171,10 @@ uint32_t ByteExtractHash(void *d)
     b += (uint32_t)data->byte_order_func;
 #endif
 
+    mix(a,b,c);
+
+    a += data->mask;
+
     final(a,b,c);
 
     return c;
@@ -154,6 +190,7 @@ int ByteExtractCompare(void *l, void *r)
 
     if ((left->bytes_to_grab == right->bytes_to_grab) &&
         (left->offset == right->offset) &&
+        (left->mask == right->mask) &&
         (left->relative_flag == right->relative_flag) &&
         (left->data_string_convert_flag == right->data_string_convert_flag) &&
         (left->align == right->align) &&
@@ -242,6 +279,7 @@ static int ByteExtractParse(ByteExtractData *data, char *args)
     RuleOptByteOrderFunc tmp_byte_order_func = NULL;
 
     /* set defaults / sentinels */
+    data->mask = 0xffffffff;
     data->multiplier = 1;
     data->endianess = ENDIAN_NONE;
 
@@ -280,6 +318,26 @@ static int ByteExtractParse(ByteExtractData *data, char *args)
             data->relative_flag = 1;
         }
 
+        else if (strncmp(token, "mask ", 5) == 0)
+        {
+            char *value = (token+5);
+            if (token == NULL)
+                ParseError("byte_extract rule option has a \"mask\" "
+                           "argument with no value specified.");
+
+            if (data->mask == 0xffffffff)
+            {
+                data->mask = SnortStrtoul(value, &endptr, 0);
+
+                if (*endptr != '\0')
+                    ParseError("byte_extract rule option has non-digits in the "
+                            "argument to \"mask\". ");
+            }
+            else
+                ParseError("byte_extract rule option has multiple "
+                        "\"mask\" arguments. Use only one.");
+        }
+
         else if (strncmp(token, "align ", 6) == 0)
         {
             char *value = (token+6);
@@ -614,6 +672,9 @@ int DetectByteExtract(void *option_data, Packet *p)
         bytes_read = ret;
     }
 
+    /* mask */
+    *value &= data->mask;
+
     /* mulitply */
     *value *= data->multiplier;
 
diff --git a/src/detection-plugins/sp_byte_extract.h b/src/detection-plugins/sp_byte_extract.h
index f14386b..1109719 100644
--- a/src/detection-plugins/sp_byte_extract.h
+++ b/src/detection-plugins/sp_byte_extract.h
@@ -43,6 +43,7 @@ typedef struct _ByteExtractData
     int32_t offset;
     uint8_t relative_flag;
     uint8_t data_string_convert_flag;
+    uint32_t mask;
     uint8_t align;
     int8_t endianess;
     uint32_t base;
diff --git a/src/detection-plugins/sp_byte_jump.c b/src/detection-plugins/sp_byte_jump.c
index fd48038..b4f7e61 100644
--- a/src/detection-plugins/sp_byte_jump.c
+++ b/src/detection-plugins/sp_byte_jump.c
@@ -33,6 +33,7 @@
  *      <offset>: number of bytes into the payload to grab the bytes
  *      Optional:
  *      ["relative"]: offset relative to last pattern match
+ *      ["mask"]: bitmask to apply to the converted bytes (bitwise AND)
  *      ["big"]: process data as big endian (default)
  *      ["little"]: process data as little endian
  *      ["string"]: converted bytes represented as a string needing conversion
@@ -163,6 +164,10 @@ uint32_t ByteJumpHash(void *d)
     a += (uint32_t)data->byte_order_func;
 #endif
 
+    mix(a,b,c);
+
+    a += data->mask;
+
     final(a,b,c);
 
     return c;
@@ -179,6 +184,7 @@ int ByteJumpCompare(void *l, void *r)
     if (( left->bytes_to_grab == right->bytes_to_grab) &&
         ( left->offset == right->offset) &&
         ( left->offset_var == right->offset_var) &&
+        ( left->mask == right->mask) &&
         ( left->relative_flag == right->relative_flag) &&
         ( left->data_string_convert_flag == right->data_string_convert_flag) &&
         ( left->from_beginning_flag == right->from_beginning_flag) &&
@@ -308,11 +314,12 @@ static void ByteJumpInit(char *data, OptTreeNode *otn, int protocol)
     if (add_detection_option(RULE_OPTION_TYPE_BYTE_JUMP, (void *)idx, &idx_dup) == DETECTION_OPTION_EQUAL)
     {
 #ifdef DEBUG_RULE_OPTION_TREE
-        LogMessage("Duplicate ByteJump:\n%d %d %c %c %c %c %c %d %d\n"
-            "%d %d %c %c %c %c %c %d %d %d\n\n",
+        LogMessage("Duplicate ByteJump:\n%d %d %c %d %c %c %c %c %d %d\n"
+            "%d %d %c %d %c %c %c %c %d %d %d\n\n",
             idx->bytes_to_grab,
             idx->offset,
             idx->relative_flag,
+            idx->mask,
             idx->data_string_convert_flag,
             idx->from_beginning_flag,
             idx->align_flag,
@@ -321,6 +328,7 @@ static void ByteJumpInit(char *data, OptTreeNode *otn, int protocol)
             ((ByteJumpData *)idx_dup)->bytes_to_grab,
             ((ByteJumpData *)idx_dup)->offset,
             ((ByteJumpData *)idx_dup)->relative_flag,
+            ((ByteJumpData *)idx_dup)->mask,
             ((ByteJumpData *)idx_dup)->data_string_convert_flag,
             ((ByteJumpData *)idx_dup)->from_beginning_flag,
             ((ByteJumpData *)idx_dup)->align_flag,
@@ -424,6 +432,25 @@ static ByteJumpOverrideData * ByteJumpParse(char *data, ByteJumpData *idx, OptTr
                 /* the offset is relative to the last pattern match */
                 idx->relative_flag = 1;
             }
+            else if(!strncasecmp(cptr, "mask ", 5))
+            {
+                /* Format of this option is mask xx.
+                 * xx is an unsigned integer.
+                 */
+                char *mval = &cptr[5];
+                long factor = 0;
+                int mask_len = strlen(cptr);
+                if (mask_len > 5)
+                {
+                    factor = strtoul(mval, &endp, 0);
+                }
+                if ((factor <= 0) || (endp != cptr + mask_len))
+                {
+                    FatalError("%s(%d): invalid length mask \"%s\"\n",
+                            file_name, file_line, cptr);
+                }
+                idx->mask = factor;
+            }
             else if(!strcasecmp(cptr, "from_beginning"))
             {
                 idx->from_beginning_flag = 1;
@@ -685,6 +712,10 @@ int ByteJump(void *option_data, Packet *p)
                             "grabbed %d of %d bytes, value = %08X\n",
                             payload_bytes_grabbed, bjd->bytes_to_grab, value););
 
+    /* Adjust the value with the bitmask. */
+    if (bjd->mask)
+        value &= bjd->mask;
+
     /* Adjust the jump_value (# bytes to jump forward) with the multiplier. */
     if (bjd->multiplier)
         jump_value = value * bjd->multiplier;
diff --git a/src/detection-plugins/sp_byte_jump.h b/src/detection-plugins/sp_byte_jump.h
index 7445d89..54d7972 100644
--- a/src/detection-plugins/sp_byte_jump.h
+++ b/src/detection-plugins/sp_byte_jump.h
@@ -31,6 +31,7 @@ typedef struct _ByteJumpData
     uint32_t bytes_to_grab; /* number of bytes to compare */
     int32_t offset;
     uint8_t relative_flag;
+    uint32_t mask;
     uint8_t data_string_convert_flag;
     uint8_t from_beginning_flag;
     uint8_t align_flag;
diff --git a/src/dynamic-preprocessors/dcerpc2/dce2_roptions.c b/src/dynamic-preprocessors/dcerpc2/dce2_roptions.c
index 03e5d1d..8d43e7b 100644
--- a/src/dynamic-preprocessors/dcerpc2/dce2_roptions.c
+++ b/src/dynamic-preprocessors/dcerpc2/dce2_roptions.c
@@ -64,6 +64,7 @@
 #define DCE2_RARG__XOR  '^'
 #define DCE2_RARG__ANY_FRAG      "any_frag"
 #define DCE2_RARG__RELATIVE      "relative"
+#define DCE2_RARG__MASK          "mask"
 #define DCE2_RARG__MULTIPLIER    "multiplier"
 #define DCE2_RARG__ALIGN         "align"
 #define DCE2_RARG__POST_OFFSET   "post_offset"
@@ -109,7 +110,6 @@ typedef enum _DCE2_BtOp
     DCE2_BT_OP__GT,
     DCE2_BT_OP__AND,
     DCE2_BT_OP__XOR
-
 } DCE2_BtOp;
 
 typedef enum _DCE2_OpnumType
@@ -184,6 +184,7 @@ typedef struct _DCE2_ByteJumpData
     int num_bytes;
     int32_t offset;   /* can be negative */
     int relative;
+    uint32_t mask;
     int multiplier;
     int align;
     int32_t post_offset;   /* can be negative */
@@ -1417,7 +1418,7 @@ static int DCE2_ByteJumpInit(char *name, char *args, void **data)
                     DCE2_Free((void *)bj_data, sizeof(DCE2_ByteJumpData), DCE2_MEM_TYPE__ROPTION);
                     DCE2_RoptError("\"%s\" rule option: Can't configure \"%s\" "
                             "more than once.",
-                            DCE2_ROPT__BYTE_TEST, DCE2_RARG__RELATIVE);
+                            DCE2_ROPT__BYTE_JUMP, DCE2_RARG__RELATIVE);
                 }
 
                 bj_data->relative = 1;
@@ -1429,11 +1430,43 @@ static int DCE2_ByteJumpInit(char *name, char *args, void **data)
                     DCE2_Free((void *)bj_data, sizeof(DCE2_ByteJumpData), DCE2_MEM_TYPE__ROPTION);
                     DCE2_RoptError("\"%s\" rule option: Can't configure \"%s\" "
                             "more than once.",
-                            DCE2_ROPT__BYTE_TEST, DCE2_RARG__ALIGN);
+                            DCE2_ROPT__BYTE_JUMP, DCE2_RARG__ALIGN);
                 }
 
                 bj_data->align = 1;
             }
+            else if (strcasecmp(arg, DCE2_RARG__MASK) == 0)
+            {
+                char *endptr;
+                uint32_t mask;
+
+                if (bj_data->mask != DCE2_SENTINEL)
+                {
+                    DCE2_Free((void *)bj_data, sizeof(DCE2_ByteJumpData), DCE2_MEM_TYPE__ROPTION);
+                    DCE2_RoptError("\"%s\" rule option: Can't configure \"%s\" "
+                            "more than once.",
+                            DCE2_ROPT__BYTE_JUMP, DCE2_RARG__MASK);
+                }
+
+                arg = strtok_r(NULL, DCE2_RTOKEN__ARG_SEP, &argptr);
+                if (arg == NULL)
+                {
+                    DCE2_Free((void *)bj_data, sizeof(DCE2_ByteJumpData), DCE2_MEM_TYPE__ROPTION);
+                    DCE2_RoptError("\"%s\" rule option: \"%s\" requires an argument.",
+                            DCE2_ROPT__BYTE_JUMP, DCE2_RARG__MASK);
+                }
+
+                mask = _dpd.SnortStrtoul(arg, &endptr, 0);
+                if ((errno == ERANGE) || (*endptr != '\0') ||
+                        (mask <= 1) || (mask > UINT32_MAX))
+                {
+                    DCE2_Free((void *)bj_data, sizeof(DCE2_ByteJumpData), DCE2_MEM_TYPE__ROPTION);
+                    DCE2_RoptError("\"%s\" rule option: Invalid mask: %s. ",
+                            DCE2_ROPT__BYTE_JUMP, arg);
+                }
+
+                bj_data->mask = mask;
+            }
             else if (strcasecmp(arg, DCE2_RARG__MULTIPLIER) == 0)
             {
                 char *endptr;
@@ -1444,7 +1477,7 @@ static int DCE2_ByteJumpInit(char *name, char *args, void **data)
                     DCE2_Free((void *)bj_data, sizeof(DCE2_ByteJumpData), DCE2_MEM_TYPE__ROPTION);
                     DCE2_RoptError("\"%s\" rule option: Can't configure \"%s\" "
                             "more than once.",
-                            DCE2_ROPT__BYTE_TEST, DCE2_RARG__MULTIPLIER);
+                            DCE2_ROPT__BYTE_JUMP, DCE2_RARG__MULTIPLIER);
                 }
 
                 arg = strtok_r(NULL, DCE2_RTOKEN__ARG_SEP, &argptr);
@@ -1477,7 +1510,7 @@ static int DCE2_ByteJumpInit(char *name, char *args, void **data)
                     DCE2_Free((void *)bj_data, sizeof(DCE2_ByteJumpData), DCE2_MEM_TYPE__ROPTION);
                     DCE2_RoptError("\"%s\" rule option: Can't configure \"%s\" "
                             "more than once.",
-                            DCE2_ROPT__BYTE_TEST, DCE2_RARG__POST_OFFSET);
+                            DCE2_ROPT__BYTE_JUMP, DCE2_RARG__POST_OFFSET);
                 }
 
                 arg = strtok_r(NULL, DCE2_RTOKEN__ARG_SEP, &argptr);
