For anything.local, you want:
\x05local.\x01
When you send a question for e.g. ftp.sub2.local, the packet will contain:
03 66 74 70 04 73 75 62 32 05 6c 6f 63 61 6c 00 00 01 00 01
f t p s u b 2 l o c a l xx yy yy zz zz
|-> match from here
Where:
- xx is null byte marking end of name
- yy yy are two bytes for question type
- zz zz are two bytes for question class
RouterOS skips all null bytes before trying to do L7 matching, which is a little complication. Fortunately, nearly all question types have values lower than 256, so they will use only one non-null byte (matched by “.”) and class is for all practical uses always 1 (matched by “\x01”).
This prevents false positives (e.g. for local.example.net), because following part would again need one byte for length (it could be matched by “.”), but there’s no way how next character could be \x01.