In most cases you can just do a string compare: if (dcerpc.last_response.stub_data == "\x09\x07\x00\x00") -HD On Monday 18 December 2006 09:55, Krpata, Tyler wrote: > If I'm looking for a certain return code at the end of the > dcerpc.last_response.stub_data, is this an ok way to do it? > if(dcerpc.last_response.stub_data =~ /\x09\x07\x00\x00$/)