--- snort_manual.tex	2010-10-08 09:58:34.000000000 +0000
+++ snort_manual-fixes.tex	2010-11-24 03:34:49.000065000 +0000
@@ -6776,8 +6776,8 @@ options:
 \begin{itemize}
 \item[]
 \begin{verbatim}
-    byte_test: dce
-    byte_jump: dce
+    byte_test:dce
+    byte_jump:dce
 \end{verbatim}
 \end{itemize}
 
@@ -6824,7 +6824,7 @@ evaluating on all fragments.\\
 \textit{Syntax}
 \footnotesize
 \begin{verbatim}
-    <uuid> [ ',' <operator> <version> ] [ ',' "any_frag" ]
+    dce_iface:<uuid>[,<operator><version>][,any_frag];
 
     uuid       = hexlong '-' hexshort '-' hexshort '-' 2hexbyte '-' 6hexbyte
     hexlong    = 4hexbyte
@@ -6837,10 +6837,10 @@ evaluating on all fragments.\\
 \textit{Examples}
 \footnotesize
 \begin{verbatim}
-    dce_iface: 4b324fc8-1670-01d3-1278-5a47bf6ee188;
-    dce_iface: 4b324fc8-1670-01d3-1278-5a47bf6ee188,<2;
-    dce_iface: 4b324fc8-1670-01d3-1278-5a47bf6ee188,any_frag;
-    dce_iface: 4b324fc8-1670-01d3-1278-5a47bf6ee188,=1,any_frag;
+    dce_iface:4b324fc8-1670-01d3-1278-5a47bf6ee188;
+    dce_iface:4b324fc8-1670-01d3-1278-5a47bf6ee188,<2;
+    dce_iface:4b324fc8-1670-01d3-1278-5a47bf6ee188,any_frag;
+    dce_iface:4b324fc8-1670-01d3-1278-5a47bf6ee188,=1,any_frag;
 \end{verbatim}
 \normalsize
 
@@ -6926,7 +6926,7 @@ exploit lies in the particular DCE/RPC f
 \textit{Syntax}
 \footnotesize
 \begin{verbatim}
-    <opnum-list>
+    dce_opnum:<opnum-list>;
 
     opnum-list   = opnum-item | opnum-item ',' opnum-list
     opnum-item   = opnum | opnum-range
@@ -6937,10 +6937,10 @@ exploit lies in the particular DCE/RPC f
 \textit{Examples}
 \footnotesize
 \begin{verbatim}
-    dce_opnum: 15;
-    dce_opnum: 15-18;
-    dce_opnum: 15,18-20;
-    dce_opnum: 15,17,20-22;
+    dce_opnum:15;
+    dce_opnum:15-18;
+    dce_opnum:15,18-20;
+    dce_opnum:15,17,20-22;
 \end{verbatim}
 \normalsize
 
@@ -6992,12 +6992,11 @@ conversion.
 \item[] \textit{Syntax}
 \footnotesize
 \begin{verbatim}
-    <convert> ',' [ '!' ] <operator> ',' <value> [ ',' <offset> [ ',' "relative" ]] \
-        ',' "dce"
+    byte_test:<convert>,[!]<operator>,<value>,<offset> [,relative],dce;
 
     convert    = 1 | 2 | 4 (only with option "dce")
     operator   = '<' | '=' | '>' | '&' | '^'
-    value      = 0-4294967295
+    value      = 0 - 4294967295
     offset     = -65535 to 65535
 \end{verbatim}
 \normalsize
@@ -7005,8 +7004,8 @@ conversion.
 \textit{Examples}
 \footnotesize
 \begin{verbatim}
-    byte_test: 4,>,35000,0,relative,dce;
-    byte_test: 2,!=,2280,-10,relative,dce;
+    byte_test:4,>,35000,0,relative,dce;
+    byte_test:2,!=,2280,-10,relative,dce;
 \end{verbatim}
 \normalsize
 
@@ -7020,13 +7019,13 @@ normal \texttt{byte\_test} arguments wil
 \item[] \textit{Syntax}
 \footnotesize
 \begin{verbatim}
-    <convert> ',' <offset> [ ',' "relative" ] [ ',' "multiplier" <mult-value> ] \
-        [ ',' "align" ] [ ',' "post_offet" <adjustment-value> ] ',' "dce"
+    byte_jump:<convert>,<offset>[,relative][,multiplier <mult_value>] \
+        [,align][,post_offet <adjustment_value>],dce;
 
     convert           = 1 | 2 | 4 (only with option "dce")
     offset            = -65535 to 65535
-    mult-value        = 0-65535
-    adjustment-value  = -65535 to 65535
+    mult_value        = 0 - 65535
+    adjustment_value  = -65535 to 65535
 \end{verbatim}
 \normalsize
 
@@ -7174,12 +7173,12 @@ This rule option specifies what type of 
 
 \textit{Syntax}
 \begin{verbatim}
-    sd_pattern: <count>,<pattern>
+    sd_pattern:<count>,<pattern>;
 \end{verbatim}
 \footnotesize
 \begin{verbatim}
 
-    count   = 1-255
+    count   = 1 - 255
     pattern = any string
 \end{verbatim}
 \normalsize
@@ -10254,7 +10253,7 @@ operator as shown in Figure \ref{Example
 \begin{figure}
 \begin{verbatim}
     alert tcp !192.168.1.0/24 any -> 192.168.1.0/24 111 \
-        (content: "|00 01 86 a5|"; msg: "external mountd access";)
+        (content:"|00 01 86 a5|"; msg:"external mountd access";)
 \end{verbatim}
 
 \caption{\label{Example Negation} Example IP Address Negation Rule}
@@ -10275,8 +10274,8 @@ action.
 \begin{figure}
 \begin{verbatim}
     alert tcp ![192.168.1.0/24,10.1.1.0/24] any -> \
-        [192.168.1.0/24,10.1.1.0/24] 111 (content: "|00 01 86 a5|"; \
-        msg: "external mountd access";)
+        [192.168.1.0/24,10.1.1.0/24] 111 (content:"|00 01 86 a5|"; \
+        msg:"external mountd access";)
 \end{verbatim}
 
 \caption{\label{IP list usage}IP Address Lists}
@@ -10385,10 +10384,10 @@ Put 'em together and they look like Figu
 
 \begin{figure}
 \begin{verbatim}
-    activate tcp !$HOME_NET any -> $HOME_NET 143 (flags: PA; \
-        content: "|E8C0FFFFFF|/bin"; activates: 1;  \
-        msg: "IMAP buffer overflow!";)
-    dynamic tcp !$HOME_NET any -> $HOME_NET 143 (activated_by: 1; count: 50;)
+    activate tcp !$HOME_NET any -> $HOME_NET 143 (flags:PA; \
+        content:"|E8C0FFFFFF|/bin"; activates:1;  \
+        msg:"IMAP buffer overflow!";)
+    dynamic tcp !$HOME_NET any -> $HOME_NET 143 (activated_by:1; count:50;)
 \end{verbatim}
 
 \caption{Activate/Dynamic Rule Example}
@@ -10439,7 +10438,7 @@ semi-colon ; character).
 \subsubsection{Format}
 
 \begin{verbatim}
-    msg: "<message text>";
+    msg:"<message text>";
 \end{verbatim}
 
 \subsection{reference}
@@ -10483,7 +10482,11 @@ arachnids&
 
 \hline 
 mcafee&
-http://vil.nai.com/vil/dispVirus.asp?virus\_k=\\
+http://vil.nai.com/vil/content/v\_\\
+
+\hline 
+osvdb&
+http://osvdb.org/show/osvdb/\\
 
 \hline 
 url&
@@ -10497,7 +10500,7 @@ http://\\
 \subsubsection{Format}
 
 \begin{verbatim}
-    reference: <id system>,<id>; [reference: <id system>,<id>;]
+    reference:<id system>,<id>; [reference:<id system>,<id>;]
 \end{verbatim}
 
 \subsubsection{Examples}
@@ -10534,7 +10537,7 @@ decoder gids.
 \subsubsection{Format}
 
 \begin{verbatim}
-    gid: <generator id>;
+    gid:<generator id>;
 \end{verbatim}
 
 \subsubsection{Example}
@@ -10565,7 +10568,7 @@ message.  
 \subsubsection{Format}
 
 \begin{verbatim}
-    sid: <snort rules id>;
+    sid:<snort rules id>;
 \end{verbatim}
 
 \subsubsection{Example}
@@ -10587,7 +10590,7 @@ the \texttt{sid} keyword.  (See section 
 \subsubsection{Format}
 
 \begin{verbatim}
-    rev: <revision integer>;
+    rev:<revision integer>;
 \end{verbatim}
 
 \subsubsection{Example}
@@ -10609,7 +10612,7 @@ the event data Snort produces.
 \subsubsection{Format}
 
 \begin{verbatim}
-    classtype: <class name>;
+    classtype:<class name>;
 \end{verbatim}
 
 \subsubsection{Example}
@@ -10760,17 +10763,17 @@ rule.  Examples of each case are given b
 \subsubsection{Format}
 
 \begin{verbatim}
-    priority: <priority integer>;
+    priority:<priority integer>;
 \end{verbatim}
 
 \subsubsection{Examples}
 
 \begin{verbatim}
-    alert TCP any any -> any 80 (msg: "WEB-MISC phf attempt"; flags:A+; \
-        content: "/cgi-bin/phf"; priority:10;)
+    alert TCP any any -> any 80 (msg:"WEB-MISC phf attempt"; flags:A+; \
+        content:"/cgi-bin/phf"; priority:10;)
 
     alert tcp any any -> any 80 (msg:"EXPLOIT ntpdx overflow"; \ 
-        dsize: >128; classtype:attempted-admin; priority:10 );
+        dsize:>128; classtype:attempted-admin; priority:10 );
 \end{verbatim}
 
 \subsection{metadata}
@@ -10826,20 +10829,20 @@ uses multiple metadata keywords, the sec
 keys separated by commas.
 
 \begin{verbatim}
-    metadata: key1 value1;
-    metadata: key1 value1, key2 value2;
+    metadata:key1 value1;
+    metadata:key1 value1, key2 value2;
 \end{verbatim}
 
 \subsubsection{Examples}
 
 \begin{verbatim}
-    alert tcp any any -> any 80 (msg: "Shared Library Rule Example"; \
+    alert tcp any any -> any 80 (msg:"Shared Library Rule Example"; \
         metadata:engine shared; metadata:soid 3|12345;)
 
-    alert tcp any any -> any 80 (msg: "Shared Library Rule Example"; \
+    alert tcp any any -> any 80 (msg:"Shared Library Rule Example"; \
         metadata:engine shared, soid 3|12345;)
 
-    alert tcp any any -> any 80 (msg: "HTTP Service Rule Example"; \
+    alert tcp any any -> any 80 (msg:"HTTP Service Rule Example"; \
         metadata:service http;)
 \end{verbatim}
 
@@ -10941,7 +10944,7 @@ Also note that the following characters 
 \subsubsection{Format}
 
 \begin{verbatim}
-    content: [!] "<content string>";
+    content:[!]"<content string>";
 \end{verbatim}
 
 \subsubsection{Examples}
@@ -11041,7 +11044,7 @@ fast\_pattern & \ref{sub:FastPattern} \\
 
 The nocase keyword allows the rule writer to specify that the Snort should look
 for the specific pattern, ignoring case.  nocase modifies the previous
-'content' keyword in the rule.
+\texttt{content} keyword in the rule.
 
 \subsubsection{Format}
 
@@ -11074,7 +11077,7 @@ This example tells the content pattern m
 instead of the decoded traffic provided by the Telnet decoder.
 
 \begin{verbatim}
-    alert tcp any any -> any 21 (msg: "Telnet NOP"; content: "|FF F1|"; rawbytes;)
+    alert tcp any any -> any 21 (msg:"Telnet NOP"; content:"|FF F1|"; rawbytes;)
 \end{verbatim}
 
 \subsection{depth}
@@ -11087,16 +11090,20 @@ keyword in the rule.
 A depth of 5 would tell Snort to only look for the specified pattern within the
 first 5 bytes of the payload.
 
-As the depth keyword is a modifier to the previous `content' keyword, there
-must be a content in the rule before `depth' is specified.
+As the depth keyword is a modifier to the previous \texttt{content} keyword, there
+must be a content in the rule before \texttt{depth} is specified.
 
-This keyword allows values equal to 0 or values greater than or equal to the pattern 
-length being searched. The maximum allowed value for this keyword is 65535.
+This keyword allows values greater than or equal to the pattern length being
+searched. The minimum allowed value is 1.  The maximum allowed value for this
+keyword is 65535.
+
+The value can also be set to a string value referencing a variable extracted by the
+\texttt{byte_extract} keyword in the same rule.
 
 \subsubsection{Format}
 
 \begin{verbatim}
-    depth: <number>;
+    depth:[<number>|<var_name>];
 \end{verbatim}
 
 \subsection{offset}
@@ -11109,15 +11116,18 @@ in the rule.
 An offset of 5 would tell Snort to start looking for the specified pattern
 after the first 5 bytes of the payload.
 
-As this keyword is a modifier to the previous 'content' keyword, there must be
-a content in the rule before 'offset' is specified.
+As this keyword is a modifier to the previous \texttt{content} keyword, there must be
+a content in the rule before \texttt{offset} is specified.
 
 This keyword allows values from -65535 to 65535.
 
+The value can also be set to a string value referencing a variable extracted by the
+\texttt{byte_extract} keyword in the same rule.
+
 \subsubsection{Format}
 
 \begin{verbatim}
-    offset: <number>;
+    offset:[<number>|<var_name>];
 \end{verbatim}
 
 \subsubsection{Example}
@@ -11126,7 +11136,7 @@ The following example shows use of a com
 rule.
 
 \begin{verbatim}
-    alert tcp any any -> any 80 (content: "cgi-bin/phf"; offset:4; depth:20;)
+    alert tcp any any -> any 80 (content:"cgi-bin/phf"; offset:4; depth:20;)
 \end{verbatim}
 
 \subsection{distance}
@@ -11142,10 +11152,13 @@ instead of the beginning of the packet.
 
 This keyword allows values from -65535 to 65535.
 
+The value can also be set to a string value referencing a variable extracted by the
+\texttt{byte_extract} keyword in the same rule.
+
 \subsubsection{Format}
 
 \begin{verbatim}
-    distance: <byte count>;
+    distance:[<byte_count>|<var_name>];
 \end{verbatim}
 
 \subsubsection{Example}
@@ -11153,7 +11166,7 @@ This keyword allows values from -65535 t
 The rule below maps to a regular expression of /ABC.\{1\}DEF/.
 
 \begin{verbatim}
-    alert tcp any any -> any any (content:"ABC"; content: "DEF"; distance:1;)
+    alert tcp any any -> any any (content:"ABC"; content:"DEF"; distance:1;)
 \end{verbatim}
 
 \subsection{within}
@@ -11167,10 +11180,13 @@ are between pattern matches using the co
 This keyword allows values greater than or equal to pattern length being searched. 
 The maximum allowed value for this keyword is 65535.
 
+The value can also be set to a string value referencing a variable extracted by the
+\texttt{byte_extract} keyword in the same rule.
+
 \subsubsection{Format}
 
 \begin{verbatim}
-    within: <byte count>;
+    within:[<byte_count>|<var_name>];
 \end{verbatim}
 
 \subsubsection{Examples}
@@ -11178,7 +11194,7 @@ The maximum allowed value for this keywo
 This rule constrains the search of EFG to not go past 10 bytes past the ABC match. 
 
 \begin{verbatim}
-    alert tcp any any -> any any (content:"ABC"; content: "EFG"; within:10;)
+    alert tcp any any -> any any (content:"ABC"; content:"EFG"; within:10;)
 \end{verbatim}
 
 \subsection{http\_client\_body}
@@ -11187,7 +11203,7 @@ This rule constrains the search of EFG t
 The http\_client\_body keyword is a content modifier that restricts the search
 to the body of an HTTP client request.
 
-As this keyword is a modifier to the previous 'content' keyword, there must be
+As this keyword is a modifier to the previous \texttt{content} keyword, there must be
 a content in the rule before 'http\_client\_body' is specified. 
 
 The amount of data that is inspected with this option depends on the \texttt{post\_depth}
@@ -11206,7 +11222,7 @@ This rule constrains the search for the 
 an HTTP client request.
 
 \begin{verbatim}
-    alert tcp any any -> any 80 (content:"ABC"; content: "EFG"; http_client_body;)
+    alert tcp any any -> any 80 (content:"ABC"; content:"EFG"; http_client_body;)
 \end{verbatim}
 
 \begin{note}
@@ -11221,9 +11237,9 @@ The http\_cookie keyword is a content mo
 extracted Cookie Header field of a HTTP client request or a HTTP server 
 response (per the configuration of HttpInspect \ref{sub:http-inspect}).
 
-As this keyword is a modifier to the previous 'content' keyword, there must be
-a content in the rule before 'http\_cookie' is specified. This keyword is dependent
-on the 'enable\_cookie' config option. The Cookie Header field will be extracted only
+As this keyword is a modifier to the previous \texttt{content} keyword, there must be
+a content in the rule before \texttt{http\_cookie} is specified. This keyword is dependent
+on the \texttt{enable\_cookie} config option. The Cookie Header field will be extracted only
 when this option is configured.
 
 The extracted Cookie Header field may be NORMALIZED, per the configuration of
@@ -11241,7 +11257,7 @@ This rule constrains the search for the 
 Header field of a HTTP client request.
 
 \begin{verbatim}
-    alert tcp any any -> any 80 (content:"ABC"; content: "EFG"; http_cookie;)
+    alert tcp any any -> any 80 (content:"ABC"; content:"EFG"; http_cookie;)
 \end{verbatim}
 
 \begin{note}
@@ -11258,9 +11274,9 @@ The http\_raw\_cookie keyword is a conte
 extracted UNNORMALIZED Cookie Header field of a HTTP client request or a HTTP server 
 response (per the configuration of HttpInspect \ref{sub:http-inspect}).
 
-As this keyword is a modifier to the previous 'content' keyword, there must be
-a content in the rule before 'http\_raw\_cookie' is specified. This keyword is dependent
-on the 'enable\_cookie' config option. The Cookie Header field will be extracted only
+As this keyword is a modifier to the previous \texttt{content} keyword, there must be
+a content in the rule before \texttt{http\_raw\_cookie} is specified. This keyword is dependent
+on the \texttt{enable\_cookie} config option. The Cookie Header field will be extracted only
 when this option is configured.
 
 \subsubsection{Format}
@@ -11275,7 +11291,7 @@ This rule constrains the search for the 
 Cookie Header field of a HTTP client request.
 
 \begin{verbatim}
-    alert tcp any any -> any 80 (content:"ABC"; content: "EFG"; http_raw_cookie;)
+    alert tcp any any -> any 80 (content:"ABC"; content:"EFG"; http_raw_cookie;)
 \end{verbatim}
 
 \begin{note}
@@ -11293,8 +11309,8 @@ The http\_header keyword is a content mo
 extracted Header fields of a HTTP client request or a HTTP server response (per the 
 configuration of HttpInspect \ref{sub:http-inspect}).
 
-As this keyword is a modifier to the previous 'content' keyword, there must be
-a content in the rule before 'http\_header' is specified.
+As this keyword is a modifier to the previous \texttt{content} keyword, there must be
+a content in the rule before \texttt{http\_header} is specified.
 
 The extracted Header fields may be NORMALIZED, per the configuration of
 HttpInspect (see \ref{sub:http-inspect}).
@@ -11311,7 +11327,7 @@ This rule constrains the search for the 
 fields of a HTTP client request or a HTTP server response.
 
 \begin{verbatim}
-    alert tcp any any -> any 80 (content:"ABC"; content: "EFG"; http_header;)
+    alert tcp any any -> any 80 (content:"ABC"; content:"EFG"; http_header;)
 \end{verbatim}
 
 \begin{note}
@@ -11328,8 +11344,8 @@ The http\_raw\_header keyword is a conte
 extracted UNNORMALIZED Header fields of a HTTP client request or a HTTP server
 response (per the configuration of HttpInspect \ref{sub:http-inspect}).
 
-As this keyword is a modifier to the previous 'content' keyword, there must be
-a content in the rule before 'http\_raw\_header' is specified.
+As this keyword is a modifier to the previous \texttt{content} keyword, there must be
+a content in the rule before \texttt{http\_raw\_header} is specified.
 
 \subsubsection{Format}
 
@@ -11343,7 +11359,7 @@ This rule constrains the search for the 
 of a HTTP client request or a HTTP server response.
 
 \begin{verbatim}
-    alert tcp any any -> any 80 (content:"ABC"; content: "EFG"; http_raw_header;)
+    alert tcp any any -> any 80 (content:"ABC"; content:"EFG"; http_raw_header;)
 \end{verbatim}
 
 \begin{note}
@@ -11360,8 +11376,8 @@ content.
 The http\_method keyword is a content modifier that restricts the search to the
 extracted Method from a HTTP client request.
 
-As this keyword is a modifier to the previous 'content' keyword, there must be
-a content in the rule before 'http\_method' is specified.
+As this keyword is a modifier to the previous \texttt{content} keyword, there must be
+a content in the rule before \texttt{http\_method} is specified.
 
 \subsubsection{Format}
 
@@ -11375,7 +11391,7 @@ This rule constrains the search for the 
 from a HTTP client request.
 
 \begin{verbatim}
-    alert tcp any any -> any 80 (content:"ABC"; content: "GET"; http_method;)
+    alert tcp any any -> any 80 (content:"ABC"; content:"GET"; http_method;)
 \end{verbatim}
 
 \begin{note}
@@ -11393,8 +11409,8 @@ NORMALIZED request \textsc{URI} field . 
 by a http\_uri modifier is the same as using a uricontent by itself (see:
 \ref{sub:UriContent}).
 
-As this keyword is a modifier to the previous 'content' keyword, there must be
-a content in the rule before 'http\_uri' is specified.
+As this keyword is a modifier to the previous \texttt{content} keyword, there must be
+a content in the rule before \texttt{http\_uri} is specified.
 
 \subsubsection{Format}
 
@@ -11407,7 +11423,7 @@ a content in the rule before 'http\_uri'
 This rule constrains the search for the pattern "EFG" to the NORMALIZED URI.
 
 \begin{verbatim}
-    alert tcp any any -> any 80 (content:"ABC"; content: "EFG"; http_uri;)
+    alert tcp any any -> any 80 (content:"ABC"; content:"EFG"; http_uri;)
 \end{verbatim}
 
 \begin{note}
@@ -11422,8 +11438,8 @@ The \texttt{http\_uri} modifier is not a
 The http\_raw\_uri keyword is a content modifier that restricts the search to the
 UNNORMALIZED request \textsc{URI} field . 
 
-As this keyword is a modifier to the previous 'content' keyword, there must be
-a content in the rule before 'http\_raw\_uri' is specified.
+As this keyword is a modifier to the previous \texttt{content} keyword, there must be
+a content in the rule before \texttt{http\_raw\_uri} is specified.
 
 \subsubsection{Format}
 
@@ -11436,7 +11452,7 @@ a content in the rule before 'http\_raw\
 This rule constrains the search for the pattern "EFG" to the UNNORMALIZED URI.
 
 \begin{verbatim}
-    alert tcp any any -> any 80 (content:"ABC"; content: "EFG"; http_raw_uri;)
+    alert tcp any any -> any 80 (content:"ABC"; content:"EFG"; http_raw_uri;)
 \end{verbatim}
 \begin{note}
 
@@ -11452,8 +11468,8 @@ content.
 The http\_stat\_code keyword is a content modifier that restricts the search to the
 extracted Status code field from a HTTP server response.
 
-As this keyword is a modifier to the previous 'content' keyword, there must be
-a content in the rule before 'http\_stat\_code' is specified. 
+As this keyword is a modifier to the previous \texttt{content} keyword, there must be
+a content in the rule before \texttt{http\_stat\_code} is specified. 
 
 The Status Code field will be extracted only if the extended\_reponse\_inspection is 
 configured for the HttpInspect (see \ref{sub:http-inspect}).
@@ -11470,7 +11486,7 @@ This rule constrains the search for the 
 of a HTTP server response.
 
 \begin{verbatim}
-    alert tcp any any -> any 80 (content:"ABC"; content: "200"; http_stat_code;)
+    alert tcp any any -> any 80 (content:"ABC"; content:"200"; http_stat_code;)
 \end{verbatim}
 
 \begin{note}
@@ -11486,8 +11502,8 @@ The \texttt{http\_stat\_code} modifier i
 The http\_stat\_msg keyword is a content modifier that restricts the search to the
 extracted Status Message field from a HTTP server response.
 
-As this keyword is a modifier to the previous 'content' keyword, there must be
-a content in the rule before 'http\_stat\_msg' is specified.
+As this keyword is a modifier to the previous \texttt{content} keyword, there must be
+a content in the rule before \texttt{http\_stat\_msg} is specified.
 
 The Status Message field will be extracted only if the extended\_reponse\_inspection is
 configured for the HttpInspect (see \ref{sub:http-inspect}).
@@ -11504,7 +11520,7 @@ This rule constrains the search for the 
 Message field of a HTTP server response.
 
 \begin{verbatim}
-    alert tcp any any -> any 80 (content:"ABC"; content: "Not Found"; http_stat_msg;)
+    alert tcp any any -> any 80 (content:"ABC"; content:"Not Found"; http_stat_msg;)
 \end{verbatim}
 
 \begin{note}
@@ -11559,7 +11575,6 @@ header fields (depending on the packet f
 \hline
 \texttt{bare\_byte} & Check for bare byte encoding in the specified buffer\\
 \hline
-\hline
 \texttt{ascii} & Check for ascii encoding in the specified buffer\\
 \hline
 \end{tabular}
@@ -11567,8 +11582,8 @@ header fields (depending on the packet f
 \subsubsection{Format}
 
 \begin{verbatim}
-    http_encode: <http buffer type>, [!] <encoding type>
-    http_encode: [uri|header|cookie], [!][<utf8|double_encode|non_ascii|base36|uencode|bare_byte|ascii>];
+    http_encode:<http buffer type>,[!]<encoding type>
+    http_encode:[uri|header|cookie],[!][<utf8|double_encode|non_ascii|base36|uencode|bare_byte|ascii>];
 \end{verbatim}
 
 \subsubsection{Examples}
@@ -11750,27 +11765,27 @@ match.  
 \subsubsection{Format}
 
 \begin{verbatim}
-    urilen: int<>int;
-    urilen: [<,>] <int>;
+    urilen:number<>number;
+    urilen:[<|>]<number>;
 \end{verbatim}
 
 The following example will match URIs that are 5 bytes long:
 
 \begin{verbatim}
-    urilen: 5
+    urilen:5
 \end{verbatim}
 
 The following example will match URIs that are shorter than 5 bytes:
 
 \begin{verbatim}
-    urilen: < 5
+    urilen:<5
 \end{verbatim}
 
 The following example will match URIs that are greater than 5 bytes and less
 than 10 bytes:
 
 \begin{verbatim}
-    urilen: 5<>10
+    urilen:5<>10
 \end{verbatim}
 
 This option works in conjunction with the HTTP Inspect preprocessor specified
@@ -11784,7 +11799,7 @@ for data relative to the end of the prev
 \subsubsection{Format}
 
 \begin{verbatim}
-    isdataat:[!] <int>[,relative|rawbytes];
+    isdataat:[!]<int>[,relative|rawbytes];
 \end{verbatim}
 
 \subsubsection{Example}
@@ -12033,7 +12048,7 @@ before decoding it.
 \subsubsection{Format}
 
 \begin{verbatim}
-	base64_decode[: [bytes <bytes_to_decode>][, ][offset <offset>[, relative]]]
+	base64_decode[:[bytes <bytes_to_decode>][, ][offset <offset>[, relative]]];
 \end{verbatim}
 
 \begin{tabular}{| l | p{4.5in} |}
@@ -12081,14 +12096,14 @@ relative rule options to work on base64 
 	content:"foo bar"; within:20;)
 
     alert tcp $EXTERNAL_NET any -> $HOME_NET any \
-	(msg:"Authorization NTLM"; content:"Authorization: NTLM";
+	(msg:"Authorization NTLM"; content:"Authorization:NTLM";
 	base64_decode:relative; base64_data; content:"NTLMSSP"; \
 	within:20;)
 
     alert tcp any any -> any any (msg:"Authorization NTLM"; \
 	content:"Authorization:"; http_header; \
-	base64_decode: bytes 12, offset 6,relative ; base64_data; \
-	content:"NTLMSSP";within:8; )
+	base64_decode:bytes 12,offset 6,relative; base64_data; \
+	content:"NTLMSSP"; within:8;)
 \end{verbatim}
 
 \subsection{base64\_data}
@@ -12121,8 +12136,8 @@ Fast pattern content matches are not all
 \begin{verbatim}
     alert tcp any any -> any any (msg:"Authorization NTLM"; \
         content:"Authorization:"; http_header; \
-        base64_decode: bytes 12, offset 6,relative ; base64_data; \
-        content:"NTLMSSP";within:8; )
+        base64_decode:bytes 12,offset 6,relative; base64_data; \
+        content:"NTLMSSP"; within:8;)
 \end{verbatim}
 
 
@@ -12140,12 +12155,12 @@ values}.
 
 \footnotesize
 \begin{verbatim}
-    byte_test: <bytes to convert>, [!]<operator>, <value>, <offset>  \
-        [,relative] [,<endian>] [,<number type>, string];
+    byte_test:<bytes to convert>,[!]<operator>,<value>,<offset>  \
+        [,relative][,<endian>][,string,<number type>][,dce];
 
-    convert    = 1 - 10
+    bytes      = 1 - 10
     operator   = '<' | '=' | '>' | '&' | '^'
-    value      = 0-4294967295
+    value      = 0 - 4294967295
     offset     = -65535 to 65535
 \end{verbatim}
 
@@ -12165,7 +12180,6 @@ used without \texttt{dce}. If used with 
 \item \textless{} - less than
 \item \textgreater{} - greater than
 \item = - equal
-\item ! - not
 \item \& - bitwise AND
 \item \textasciicircum{} - bitwise OR
 \end{itemize}\\
@@ -12203,8 +12217,7 @@ converted.  See section \ref{sub:dcerpc2
 
 Any of the operators can also include \emph{!} to check if the operator is not
 true.  If \emph{!} is specified without an operator, then the operator is set
-to \emph{=}. Please note that the \emph{!} operator cannot be used with itself.
-For example, \emph{!!} is not allowed.
+to \emph{=}.
 
 \begin{note}
 
@@ -12218,36 +12231,36 @@ operator is used, then it would be the s
 
 \begin{verbatim}
     alert udp $EXTERNAL_NET any -> $HOME_NET any \
-        (msg:"AMD procedure 7 plog overflow "; \
-        content: "|00 04 93 F3|"; \
-        content: "|00 00 00 07|"; distance: 4; within: 4; \
-        byte_test: 4,>, 1000, 20, relative;)
+        (msg:"AMD procedure 7 plog overflow"; \
+        content:"|00 04 93 F3|"; \
+        content:"|00 00 00 07|"; distance:4; within:4; \
+        byte_test:4,>,1000,20,relative;)
     
     alert tcp $EXTERNAL_NET any -> $HOME_NET any \
-        (msg:"AMD procedure 7 plog overflow "; \
-        content: "|00 04 93 F3|"; \
-        content: "|00 00 00 07|"; distance: 4; within: 4; \
-        byte_test: 4, >,1000, 20, relative;)
+        (msg:"AMD procedure 7 plog overflow"; \
+        content:"|00 04 93 F3|"; \
+        content:"|00 00 00 07|"; distance:4; within:4; \
+        byte_test:4,>,1000,20,relative;)
     
     alert udp any any -> any 1234 \
-        (byte_test: 4, =, 1234, 0, string, dec; \
-        msg: "got 1234!";)
+        (byte_test:4,=,1234,0,string,dec; \
+        msg:"got 1234!";)
     
     alert udp any any -> any 1235 \
-        (byte_test: 3, =, 123, 0, string, dec; \
-        msg: "got 123!";)
+        (byte_test:3,=,123,0,string,dec; \
+        msg:"got 123!";)
     
     alert udp any any -> any 1236 \
-        (byte_test: 2, =, 12, 0, string, dec; \
-        msg: "got 12!";)
+        (byte_test:2,=,12,0,string,dec; \
+        msg:"got 12!";)
     
     alert udp any any -> any 1237 \
-        (byte_test: 10, =, 1234567890, 0, string, dec; \
-        msg: "got 1234567890!";)
+        (byte_test:10,=,1234567890,0,string,dec; \
+        msg:"got 1234567890!";)
     
     alert udp any any -> any 1238 \
-        (byte_test: 8, =, 0xdeadbeef, 0, string, hex; \
-        msg: "got DEADBEEF!";)
+        (byte_test:8,=,0xdeadbeef,0,string,hex; \
+        msg:"got DEADBEEF!";)
 \end{verbatim}
 
 \subsection{byte\_jump}
@@ -12270,14 +12283,15 @@ values}.
 \subsubsection{Format}
 
 \begin{verbatim}
-    byte_jump: <bytes_to_convert>, <offset> \
-        [,relative] [,multiplier <multiplier value>] [,big] [,little][,string]\
-        [,hex] [,dec] [,oct] [,align] [,from_beginning] [,post_offset <adjustment value>];
-
-    convert    = 1 - 10
-    operator   = '<' | '=' | '>' | '&' | '^'
-    value      = 0-4294967295
-    offset     = -65535 to 65535
+    byte_jump:<bytes_to_convert>,<offset> \
+        [,relative][,multiplier <mult_value>][,<endian>][,string,<number_type>]\
+        [,align][,from_beginning][,post_offset <adjustment value>][,dce];
+
+    bytes       = 1 - 10
+    offset      = -65535 to 65535
+    mult_value  = 0 - 65535
+    post_offset = -65535 to 65535
+    
 \end{verbatim}
 
 \begin{tabular}{| l | p{4.5in} |}
@@ -12327,11 +12341,11 @@ examples (\ref{dcerpc2:byte_test_jump} f
 \subsubsection{Example}
 
 \begin{verbatim}
-    alert udp any any -> any 32770:34000 (content: "|00 01 86 B8|"; \
-        content: "|00 00 00 01|"; distance: 4; within: 4; \
-        byte_jump: 4, 12, relative, align; \
-        byte_test: 4, >, 900, 20, relative; \
-        msg: "statd format string buffer overflow";)
+    alert udp any any -> any 32770:34000 (content:"|00 01 86 B8|"; \
+        content:"|00 00 00 01|"; distance:4; within:4; \
+        byte_jump:4,12,relative,align; \
+        byte_test:4,>,900,20,relative; \
+        msg:"statd format string buffer overflow";)
 \end{verbatim}
 
 \subsection{byte\_extract}
@@ -12352,9 +12366,9 @@ re-used in the same rule any number of t
 \subsubsection{Format}
 
 \begin{verbatim}
-    byte_extract: <bytes_to_extract>, <offset>, <name> \
-        [,relative] [,multiplier <multiplier value>] [,big] [,little] [,dce]\ 
-        [,string] [,hex] [,dec] [,oct] [,align <align value>] 
+    byte_extract:<bytes_to_extract>,<offset>,<name> \
+        [,relative][,multiplier <multiplier value>][,<endian>]\ 
+        [,string,<number_type>][,align <align value>][,dce]
 \end{verbatim}
 
 \begin{tabular}{| l | p{4.5in} |}
@@ -12413,8 +12427,6 @@ where \texttt{byte\_extract} variables c
 \hline
 \texttt{byte\_jump} & \texttt{offset}\\
 \hline
-\texttt{byte\_extract} & \texttt{offset}\\
-\hline
 \texttt{isdataat} & \texttt{offset}\\
 \hline
 \end{tabular}
@@ -12429,10 +12441,10 @@ This example uses two variables to:
 \end{itemize}
 
 \begin{verbatim}
-    alert tcp any any -> any any (byte_extract: 1, 0, str_offset; \
-        byte_extract: 1, 1, str_depth; \
-        content: "bad stuff"; offset: str_offset; depth: str_depth; \
-        msg: "Bad Stuff detected within field";)
+    alert tcp any any -> any any (byte_extract:1,0,str_offset; \
+        byte_extract:1,1,str_depth; \
+        content:"bad stuff"; offset:str_offset; depth:str_depth; \
+        msg:"Bad Stuff detected within field";)
 \end{verbatim}
 
 \subsection{ftpbounce}
@@ -12471,7 +12483,7 @@ space between option and argument.
 \subsubsection{Format}
 
 \begin{verbatim}
-    asn1: option[ argument][, option[ argument]] . . . 
+    asn1:[bitstring_overflow][,double_overflow][,oversize_length <value>][,absolute_offset <value>|relative_offset <value>][,print];
 \end{verbatim}
 
 \begin{tabular}{| l | p{4.5in} |}
@@ -12514,7 +12526,7 @@ positive or negative. \\  
 This is the relative offset from the last content match or byte\_test/jump.
 \texttt{relative\_offset} has one argument, the offset number.  So if you
 wanted to start decoding and ASN.1 sequence right after the content ``foo'',
-you would specify \verb!'content:"foo"; asn1: bitstring_overflow, relative_offset 0'!.
+you would specify \verb!'content:"foo"; asn1:bitstring_overflow,relative_offset 0'!.
 Offset values may be positive or negative. \\ 
 
 \hline
@@ -12524,10 +12536,10 @@ Offset values may be positive or negativ
 
 \begin{verbatim}
     alert udp any any -> any 161 (msg:"Oversize SNMP Length"; \
-        asn1: oversize_length 10000, absolute_offset 0;)
+        asn1:oversize_length 10000,absolute_offset 0;)
         
     alert tcp any any -> any 80 (msg:"ASN1 Relative Foo"; content:"foo"; \
-        asn1: bitstring_overflow, relative_offset 0;)
+        asn1:bitstring_overflow,relative_offset 0;)
 \end{verbatim}
 
 \subsection{cvs}
@@ -12758,7 +12770,7 @@ conjunction with a fragoffset of 0.
 
 \begin{verbatim}
     alert ip any any -> any any \
-        (msg: "First Fragment"; fragbits: M; fragoffset: 0;)
+        (msg:"First Fragment"; fragbits:M; fragoffset:0;)
 \end{verbatim}
 
 \subsection{ttl}
@@ -12770,7 +12782,8 @@ keyword was intended for use in the dete
 \subsubsection{Format}
 
 \begin{verbatim}
-    ttl:[[<number>-]><=]<number>;
+    ttl:[<,>,=,<=,>=]<number>;
+    ttl:[<number>]-[<number>];
 \end{verbatim}
 
 \subsubsection{Example}
@@ -12869,7 +12882,8 @@ The following options may be checked:
 \item [ts] - Time Stamp 
 \item [sec] - IP Security
 \item [esec] - IP Extended Security
-\item [lsrr] - Loose Source Routing 
+\item [lsrr] - Loose Source Routing
+\item [lsrre] - Loose Source Routing (For MS99-038 and CVE-1999-0909) 
 \item [ssrr] - Strict Source Routing 
 \item [satid] - Stream identifier
 \item [any] - any IP options are set
@@ -12881,7 +12895,7 @@ which aren't used in any widespread inte
 \subsubsection{Format}
 
 \begin{verbatim}
-    ipopts:<rr|eol|nop|ts|sec|esec|lsrr|ssrr|satid|any>;
+    ipopts:<rr|eol|nop|ts|sec|esec|lsrr|lsrre|ssrr|satid|any>;
 \end{verbatim}
 
 \subsubsection{Example}
@@ -12941,7 +12955,8 @@ buffer overflows.
 \subsubsection{Format}
 
 \begin{verbatim}
-    dsize: [<>]<number>[<><number>];
+    dsize:number<>number;
+    dsize:[<|>]<number>;
 \end{verbatim}
 
 \subsubsection{Example}
@@ -12964,14 +12979,14 @@ The flags keyword is used to check if sp
 The following bits may be checked:
 
 \begin{description}
-\item [F] - FIN (LSB in TCP Flags byte)
-\item [S] - SYN 
-\item [R] - RST 
-\item [P] - PSH 
-\item [A] - ACK 
-\item [U] - URG 
-\item [1] - Reserved bit 1 (MSB in TCP Flags byte)
-\item [2] - Reserved bit 2 
+\item [F] - FIN - Finish (LSB in TCP Flags byte)
+\item [S] - SYN - Synchronize sequence numbers
+\item [R] - RST - Reset
+\item [P] - PSH - Push
+\item [A] - ACK - Acknowledgment
+\item [U] - URG - Urgent
+\item [1] - CWR - Congestion Window Reduced (MSB in TCP Flags byte)
+\item [2] - ECE - ECN-Echo (If SYN, then ECN capable.  Else, CE flag in IP header is set)
 \item [0] - No TCP Flags Set
 \end{description}
 
@@ -12992,7 +13007,7 @@ bits.
 \subsubsection{Format}
 
 \begin{verbatim}
-    flags:[!|*|+]<FSRPAU120>[,<FSRPAU120>];
+    flags:[!|*|+]<FSRPAU120>[,<FSRPAUA12>];
 \end{verbatim}
 
 \subsubsection{Example}
@@ -13015,7 +13030,7 @@ This allows rules to only apply to clien
 related to \$HOME\_NET clients viewing web pages to be distinguished from
 servers running in the \$HOME\_NET.
 
-The established keyword will replace the \texttt{flags: A+} used in many places
+The established keyword will replace the \texttt{flags:+A} used in many places
 to show established TCP connections.
 
 \subsubsection*{Options}
@@ -13049,7 +13064,7 @@ packets\\
 \subsubsection{Format}
 
 \begin{verbatim}
-    flow: [(established|stateless)] 
+    flow:[(established|stateless)] 
         [,(to_client|to_server|from_client|from_server)]
         [,(no_stream|only_stream)];
 \end{verbatim}
@@ -13060,7 +13075,7 @@ packets\\
     alert tcp !$HOME_NET any -> $HOME_NET 21 (msg:"cd incoming detected"; \
         flow:from_client; content:"CWD incoming"; nocase;)
 
-    alert tcp !$HOME_NET 0 -> $HOME_NET 0 (msg: "Port 0 TCP traffic"; \
+    alert tcp !$HOME_NET 0 -> $HOME_NET 0 (msg:"Port 0 TCP traffic"; \
         flow:stateless;)
 \end{verbatim}
 
@@ -13102,12 +13117,14 @@ if the state is set.\\
 \hline
 \texttt{noalert} & Cause the rule to not generate an alert, regardless of the rest of the detection options.\\
 \hline
+\texttt{reset} & Reset all states on a given flow.\\
+\hline
 \end{tabular}
 
 \subsubsection{Format}
 
 \begin{verbatim}
-    flowbits: [set|unset|toggle|isset|reset|noalert][,<STATE_NAME>][,<GROUP_NAME>];
+    flowbits:[set|unset|toggle|isset|isnotset|noalert|reset][,<STATE_NAME>][,<GROUP_NAME>];
 \end{verbatim}
 
 \subsubsection{Examples}
@@ -13147,7 +13164,7 @@ The ack keyword is used to check for a s
 \subsubsection{Format}
 
 \begin{verbatim}
-    ack: <number>;
+    ack:<number>;
 \end{verbatim}
 
 \subsubsection{Example}
@@ -13183,7 +13200,8 @@ The itype keyword is used to check for a
 \subsubsection{Format}
 
 \begin{verbatim}
-    itype:[<|>]<number>[<><number>];
+    itype:number<>number;
+    itype:[<|>]<number>;
 \end{verbatim}
 
 \subsubsection{Example}
@@ -13201,7 +13219,8 @@ The icode keyword is used to check for a
 \subsubsection{Format}
 
 \begin{verbatim}
-    icode: [<|>]<number>[<><number>];
+    icode:number<>number;
+    icode:[<|>]<number>;
 \end{verbatim}
 
 \subsubsection{Example}
@@ -13209,12 +13228,12 @@ The icode keyword is used to check for a
 This example looks for an ICMP code greater than 30.
 
 \begin{verbatim}
-    code:>30;
+    icode:>30;
 \end{verbatim}
 
 \subsection{icmp\_id}
 
-The icmp\_id keyword is used to check for a specific ICMP ID value.
+The icmp_id keyword is used to check for a specific ICMP ID value.
 
 This is useful because some covert channel programs use static ICMP fields when
 they communicate.  This particular plugin was developed to detect the
@@ -13266,7 +13285,7 @@ Wildcards are valid for both version and
 \subsubsection{Format}
 
 \begin{verbatim}
-    rpc: <application number>, [<version number>|*], [<procedure number>|*]>;
+    rpc:<application number>,[<version number>|*],[<procedure number>|*]>;
 \end{verbatim}
 
 \subsubsection{Example}
@@ -13274,7 +13293,7 @@ Wildcards are valid for both version and
 The following example looks for an RPC portmap GETPORT request.
 
 \begin{verbatim}
-    alert tcp any any -> any 111 (rpc: 100000,*,3;);
+    alert tcp any any -> any 111 (rpc:100000,*,3;);
 \end{verbatim}
 
 \subsubsection{Warning}
@@ -13336,7 +13355,7 @@ enabled.
 \subsubsection{Format}
 
 \begin{verbatim}
-    stream_reassemble:<enable|disable>,<server|client|both> [,noalert] [,fastpath]
+    stream_reassemble:<enable|disable>,<server|client|both>[,noalert][,fastpath]
 \end{verbatim}
 
 \begin{itemize}
@@ -13352,7 +13371,7 @@ For example, to disable TCP reassembly f
 HTTP 200 Ok Response message, use:
 
 \begin{verbatim}
-    alert tcp any 80 -> any any (flow:to_client,established;  content:"200 OK";
+    alert tcp any 80 -> any any (flow:to_client,established; content:"200 OK";
        stream_reassemble:disable,client,noalert;)
 \end{verbatim}
 
@@ -13371,7 +13390,7 @@ enabled.
 \subsubsection{Format}
 
 \begin{verbatim}
-    stream_size:<server|client|both|either>,<operator>,<number>
+    stream_size:<server|client|both|either>,<operator>,<number>;
 \end{verbatim}
 
 Where the operator is one of the following:
@@ -13380,7 +13399,7 @@ Where the operator is one of the followi
 \item $<$ - less than
 \item $>$ - greater than
 \item = - equal
-\item != - not
+\item != - not equal
 \item $<$= - less than or equal
 \item $>$= - greater than or equal
 \end{itemize}
@@ -13533,17 +13552,18 @@ The session keyword is built to extract 
 many cases where seeing what users are typing in telnet, rlogin, ftp, or even
 web sessions is very useful. 
 
-There are two available argument keywords for the session rule option,
-printable or all. The printable keyword only prints out data that the user
-would normally see or be able to type. 
+There are three available argument keywords for the session rule option:
+\texttt{printable}, \texttt{binary}, or \texttt{all}.
 
-The all keyword substitutes non-printable characters with their hexadecimal
-equivalents. 
+The \texttt{printable} keyword only prints out data that the user
+would normally see or be able to type.  The \texttt{binary} keyword prints out data in a
+binary format. The \texttt{all} keyword substitutes non-printable characters with
+their hexadecimal equivalents. 
 
 \subsubsection{Format}
 
 \begin{verbatim}
-    session: [printable|all];
+    session:[printable|binary|all];
 \end{verbatim}
 
 \subsubsection{Example}
@@ -13587,7 +13607,7 @@ section}, does not properly handle \emph
 \subsubsection{Format}
 
 \begin{verbatim}
-    tag: <type>, <count>, <metric>, [direction];
+    tag:<type>,[0,packets,]<count>,<metric>[,direction];
 \end{verbatim}
 
 \begin{description}{}
@@ -13678,7 +13698,7 @@ information.
 \subsubsection{Format}
 
 \begin{verbatim}
-    activates: 1;
+    activates:1;
 \end{verbatim}
 
 \subsection{activated\_by}
@@ -13690,7 +13710,7 @@ rules} for more information.
 \subsubsection{Format}
 
 \begin{verbatim}
-    activated_by: 1;
+    activated_by:1;
 \end{verbatim}
 
 \subsection{count}
@@ -13703,7 +13723,7 @@ packets to leave the rule enabled for af
 \subsubsection{Format}
 
 \begin{verbatim}
-    activated_by: 1; count: 50;
+    activated_by:1; count:50;
 \end{verbatim}
 
 \subsection{replace}
@@ -13715,7 +13735,7 @@ the new string and the content it is to 
 can have multiple replacements within a rule, one per content.
 
 \begin{verbatim}
-    replace: <string>;
+    replace:"<string>";
 \end{verbatim}
 
 \subsection{detection\_filter}
@@ -13726,9 +13746,7 @@ destination host before a rule can gener
 the following format:
 
 \begin{verbatim}
-    detection_filter: \
-        track <by_src|by_dst>, \
-        count <c>, seconds <s>;
+    detection_filter:track <by_src|by_dst>,count <c>, seconds <s>;
 \end{verbatim}
 
 \begin{table}[h]
@@ -13776,7 +13794,7 @@ attempts:
         msg:"SSH Brute Force Attempt";
         flow:established,to_server; \
         content:"SSH"; nocase; offset:0; depth:4; \
-        detection_filter: track by_src, count 30, seconds 60; \
+        detection_filter:track by_src,count 30,seconds 60; \
         sid:1000001; rev:1;)
 \end{verbatim}
 
@@ -13880,10 +13898,7 @@ integral part of this rule.
 \paragraph{Format}
 
 \begin{verbatim}
-    threshold: \
-        type <limit|threshold|both>, \
-        track <by_src|by_dst>, \
-        count <c>, seconds <s>;
+    threshold:type <limit|threshold|both>,track <by_src|by_dst>,count <c>, seconds <s>;
 \end{verbatim}
 
 \begin{table}[h]
@@ -13933,10 +13948,10 @@ This rule logs the first event of this S
 
 \begin{verbatim}
     alert tcp $external_net any -> $http_servers $http_ports \
-        (msg:"web-misc robots.txt access"; flow:to_server, established; \
+        (msg:"web-misc robots.txt access"; flow:to_server,established; \
         uricontent:"/robots.txt"; nocase; reference:nessus,10302; \
-        classtype:web-application-activity; threshold: type limit, track \
-        by_src, count 1 , seconds 60 ; sid:1000852; rev:1;)
+        classtype:web-application-activity; threshold:type limit,track \
+        by_src,count 1 ,seconds 60; sid:1000852; rev:1;)
 \end{verbatim}
 
 This rule logs every 10th event on this SID during a 60 second interval. So if
@@ -13947,7 +13962,7 @@ logged, a new time period starts for typ
     alert tcp $external_net any -> $http_servers $http_ports \
         (msg:"web-misc robots.txt access"; flow:to_server, established; \
         uricontent:"/robots.txt"; nocase; reference:nessus,10302; \
-        classtype:web-application-activity; threshold: type threshold, \
+        classtype:web-application-activity; threshold:type threshold, \
         track by_dst, count 10 , seconds 60 ; sid:1000852; rev:1;)
 \end{verbatim}
 
@@ -13958,8 +13973,8 @@ SID are fired.
     alert tcp $external_net any -> $http_servers $http_ports \
         (msg:"web-misc robots.txt access"; flow:to_server, established; \
         uricontent:"/robots.txt"; nocase; reference:nessus,10302; \
-        classtype:web-application-activity; threshold: type both , track \
-        by_dst, count 10 , seconds 60 ; sid:1000852; rev:1;)
+        classtype:web-application-activity; threshold:type both,track \
+        by_dst,count 10,seconds 60; sid:1000852; rev:1;)
 \end{verbatim}
 
 \section{Writing Good Rules}
