Pseries Installation Guide

P-Series Installation and Operation Guide, version 2.3.1.2 67

depth No No

dsize Yes No

flags Yes Yes, no wild card

flow Yes No

fragbits Yes No

fragoffset Yes No

icmp_id Yes Yes

icmp_seq Yes Yes

icode Yes Yes

id Yes Yes

ip_proto Yes Yes

itype Yes Yes

offset No No

nocase Yes No

protocol ICMP, UDP, TCP, IP ARP, ICMP, UDP, TCP, IP

seq Yes Yes

source address Yes Only /8/16/24/32 masks

destination address Yes Only /8/16/24/32 masks

source port Yes Yes, no ranges

destination port Yes Yes, no ranges

tos Yes Yes

ttl Yes Yes

uricontent Yes, no negative. No

window Yes No

within No No

Table 19 Supported Snort Keywords for Static and Dynamic Rules

Keyword Static Dynamic