OpenSignatures syntax

The Network IPS appliance supports these syntax options for custom OpenSignatures rules.

Important: OpenSignatures require the content keyword to function properly. If the OpenSignature rule is improperly formatted, you might receive a PAM configuration error response.

Table 1. OpenSignatures syntax
Options	Syntax
`<action>`	`alert`
`<protocol>`	`tcp, udp, icmp, icmpv6, ip`
`<IP and netmask>`	`single IP address (a.b.c.d)` `range of IP addresses (a.b.c.d-w.x.y.z)` `network address using CIDR notation (a.b.c.0/24)`
The negation operator	`!` Example: `alert tcp !192.168.1.0/24` This option means that an alert prompts you when anything other than what is indicated with the '`!`' is used.