Content-specific keyword modifier descriptions for OpenSignatures

For Network IPS appliances, use these supported content specific keywords as modifiers for OpenSignatures.

Note: You must use content in the rule before you can use any other modifier.
Table 1. Content-specific keyword modifiers
Use this keyword To do this action
Depth Specify how far into a packet to search for the specified pattern. For example, a 'depth' of 10 would look for the specified pattern in only the first 10 bytes of the payload.
Syntax: depth: <number>;
Example: alert tcp any any -> any any (msg:"""Search for the depth of payload of google""";content:"""|74 69 6f 6e|""";depth:10;sid:1000;)
Offset Specify where to start searching for a pattern within a packet. An 'offset' of 10 would start looking for the specified pattern after the first 10 bytes of the payload.
Syntax: offset: <number>;
Example: alert tcp any any -> any any (msg:"""offset in payload of google""";content:"""google""";offset:20;sid:1000;)
Distance Specify how far into a packet to ignore information before it starts to search for the specified pattern relative to the end of the previous pattern match. Much like 'depth', only relative to the end of the last pattern match instead of the beginning of the packet.
Syntax: distance: <byte count>;
Example: alert tcp any any -> any any (msg:"""distance specified between content when accessing google""";content:"""google""";content:"""Content-Encoding""";distance:150;sid:1000;)
Within Ensure that at most <n> bytes are between pattern matches by using the content. Use this keyword with the 'distance' modifier.
Syntax: within: <byte count>;
Example: alert tcp any any -> any any (msg:"""Search for the string in payload""";content:"""google""";content:"""|43 6f 6e 74 65 6e|""";distance:64;within:30;sid:1000;)
Nocase Look for a specific pattern, ignoring case.
Syntax: nocase;
Example: alert tcp any any -> any any (msg:"""Alert when access google""";content:"""google""";nocase;sid:1000;)