Meta tags:
description=;

Headings (most frequently used words):

rule, snort, writing, guide, option, syntax, key, italicized, strings, square, brackets, curly, braces, ellipses,

Text of the page (most frequently used words):
rule (25), the (24), and (21), options (16), food (13), specific (11), snort (10), #option (9), that (8), example (7), pizza (6), cookies (6), writer (6), must (6), can (6), rules (6), following (5), items (5), one (5), for (4), square (4), are (4), strings (4), key (4), syntax (4), writing (4), detection (4), separated (3), group (3), curly (3), choose (3), nocase (3), brackets (3), value (3), italicized (3), with (3), guide (3), would (2), valid (2), string (2), any (2), number (2), some (2), but (2), braces (2), indicate (2), pipe (2), characters (2), none (2), them (2), optional (2), placeholders (2), when (2), values (2), types (2), this (2), replace (2), page (2), payload (2), service (2), file (2), basics (2), using (2), entry, bacon, specify, plus, commas, three, dots, indicates, argument, other, modifier, repeated, times, ellipsis, applies, entire, whether, brace, bracket, ellipses, either, not, both, select, only, optionally, add, enclosed, item, between, then, all, entries, cheese, user, write, followed, important, note, different, data, such, integers, make, sure, take, into, account, specifying, serve, arbitrary, sees, they, appropriate, each, features, format, section, describes, how, formatted, simple, specified, just, name, while, others, more, complicated, have, mix, required, arguments, serves, help, understand, you, will, find, those, sections, dark, light, snortml, hexdump, lua, shared, object, miscellaneous, information, tag, detection_filter, post, stream_size, stream_reassemble, rpc, icmp_seq, icmp_id, icode, itype, window, ack, seq, file_type, flowbits, flow, flags, ip_proto, fragbits, ipopts, tos, ttl, fragoffset, non, s7commplus, modbus, mms, iec, 104, cip, dnp3, gtp, md5, sha256, sha512, cvs, sd_pattern, sip, dce, ssl_state, ssl_version, ber_data, ber_skip, byte_jump, byte_math, byte_test, byte_extract, base64_decode, base64_data, vba_data, js_data, file_data, raw_data, pkt_data, regex, pcre, dsize, isdataat, bufferlen, combining, request, response, http_trailer_test, http_header_test, http_num_cookies, http_num_trailers, http_num_headers, http_max_trailer_line, http_max_header_line, http_version_match, http_true_ip, http_trailer, http_raw_trailer, http_raw_request, http_raw_status, http_stat_msg, http_stat_code, http_version, http_method, http_param, http_client_body, http_raw_body, http_cookie, http_raw_cookie, http_header, http_raw_header, http_uri, http_raw_uri, http, offset, depth, distance, within, width, endian, fast_pattern, content, file_meta, rem, metadata, priority, classtype, rev, sid, gid, reference, msg, general, identification, new, direction, operators, port, numbers, addresses, protocols, actions, headers, alert, logging, trace, modules, tweaks, scripts, wizard, binder, configuration, reading, traffic, command, line, installing, getting, started, introduction,

Text of the page (random words):
rule option syntax key snort 3 rule writing guide snort 3 rule writing guide introduction using snort 3 getting started with snort 3 installing snort using snort command line basics reading traffic configuration rules wizard and binder tweaks and scripts trace modules alert logging writing snort rules the basics rule headers rule actions protocols ip addresses port numbers direction operators new rule types service rules file rules file identification rules rule options rule option syntax key general rule options msg reference gid sid rev classtype priority metadata service rem file_meta payload detection rule options content fast_pattern nocase width and endian offset depth distance and within http specific options http_uri and http_raw_uri http_header and http_raw_header http_cookie and http_raw_cookie http_client_body and http_raw_body http_param http_method http_version http_stat_code http_stat_msg http_raw_request and http_raw_status http_trailer and http_raw_trailer http_true_ip http_version_match http_max_header_line http_max_trailer_line http_num_headers http_num_trailers http_num_cookies http_header_test http_trailer_test combining request and response detection bufferlen isdataat dsize pcre regex pkt_data raw_data file_data js_data vba_data base64_decode and base64_data byte_extract byte_test byte_math byte_jump ber_data and ber_skip ssl_state and ssl_version dce specific options sip specific options sd_pattern cvs md5 sha256 and sha512 gtp specific options dnp3 specific options cip specific options iec 104 specific options mms specific options modbus specific options s7commplus specific options non payload detection rule options fragoffset ttl tos id ipopts fragbits ip_proto flags flow flowbits file_type seq ack window itype icode icmp_id icmp_seq rpc stream_reassemble stream_size post detection rule options detection_filter replace tag miscellaneous information shared object rules hexdump lua snortml snort light snort dark snort 3 rule writing guide rule option syntax key each rule option page features a format section that describes how the specific rule option can be formatted some rule options are simple and specified with just the option name while others are more complicated and have a mix of required and optional arguments this page serves as a key to help understand the syntax that you will find in those sections italicized strings italicized strings serve as placeholders for arbitrary values when one sees this option they must replace it with an appropriate value it s important to note italicized strings can be placeholders for different types of data such as strings or integers and so one must make sure take that into account when specifying a value or values in the following example the user must write food followed a food value food food for example food pizza food cookies and food cheese would all be valid entries square brackets square brackets indicate that the enclosed item or items are optional if the items in the square brackets are separated between pipe characters then the rule writer can choose one of the items or none of them in the following example the rule writer can choose pizza or cookies or none of them pizza cookies and in the following example the rule writer can optionally add the nocase string nocase curly braces curly braces indicate that the rule writer must select one but only one of the items separated by pipe characters in the following example the rule writer must choose either pizza or cookies but not both pizza cookies ellipses three dots indicates that a rule option a rule option argument or some other modifier can be repeated any number of times an ellipsis applies to the entire group that it s in whether that s a curly brace group or a square bracket group in the following example the rule writer must specify the string food plus any number of food items separated by commas food food food for example food pizza cookies bacon would be a valid entry