Pseries Installation Guide

P-Series Installation and Operation Guide, version 2.3.1.2 121
ttl This keyword checks for the specified IP time-to-live
value.
ttl: [number {>|<|=} | number- |
{-|>|<|=}] number;
uricontent Searches the normalized request URI field for the
specified content.
data_string can contain mixed text and binary data.
Binary data is enclosed within pipe characters and is
written in hexadecimal form.
uricontent: [!] “data_string”;
Table 28 Description of P-Series Snort Keywords
Keyword Description Rule Syntax