Force10 Networks PSeries 100-00055-01 - Manual (Page 67)

P-Series Installation and Operation Guide, version 2.3.1.2 67
depth No No
dsize Yes No
flags Yes Yes, no wild card
flow Yes No
fragbits Yes No
fragoffset Yes No
icmp_id Yes Yes
icmp_seq Yes Yes
icode Yes Yes
id Yes Yes
ip_proto Yes Yes
itype Yes Yes
offset No No
nocase Yes No
protocol ICMP, UDP, TCP, IP ARP, ICMP, UDP, TCP, IP
seq Yes Yes
source address
Yes Only /8/16/24/32 masks
destination address
Yes Only /8/16/24/32 masks
source port Yes Yes, no ranges
destination port
Yes Yes, no ranges
tos Yes Yes
ttl Yes Yes
uricontent Yes, no negative. No
window Yes No
within No No
Table 19 Supported Snort Keywords for Static and Dynamic Rules
Keyword Static Dynamic