Force10 Networks 100-00055-01 manual Description of P-Series Snort Keywords, Flags!*+ FSRPAU120

Appendix B Snort Keywords

Table 28 describes briefly the valid Snort keywords supported on the P-Series. For a more detailed explanation for these keywords, see the Snort website at http://www.snort.org/docs/snort_manual/ node17.html.

Table 28 Description of P-Series Snort Keywords

Keyword	Description		Rule Syntax
ack	Checks for a specific TCP acknowledgment number.		ack: number;
	number is a reference to a previously transmitted
	sequence number that is being acknowleged.
content	Specifies the content within the packet payload for which		content: [!] "data_string";
	the rule is to search.
	data_string can contain mixed text and binary data.
	Binary data is enclosed within pipe characters and is
	written in hexadecimal form.
dsize	Inspects the packet payload size.		dsize: [><] number [><number];
	number is the payload size in bytes.
flags	Checks for the presence of the specified TCP flag bits.		flags:[!*+] {FSRPAU120}
	Valid flag bits include:		[,{FSRPAU120}];
	• F: FIN (Least Significant Bit (LSB) in the TCP Flags
		byte)
	•	S: SYN
	•	R: RST
	•	P: PSH
	•	A: ACK
	•	U: URG
	• 1: Reserved bit 1 (Most Significant Bit (MSB) in TCP
		Flags byte)
	•	2: Reserved bit 2
	• 0: No TCP Flags Set

The following modifiers change the match criteria:

•+: Match on the specified bits, plus any others.

•*: Match if any of the specified bits are set.

•!: Match if the specified bits are not set.

P-Series Installation and Operation Guide, version 2.3.1.2 119