From 845ba154a6ff869ac8a65dfd3b85142b7f8762c0 Mon Sep 17 00:00:00 2001 From: jason taylor Date: Fri, 3 Jun 2022 19:08:14 +0000 Subject: [PATCH] doc: add tcp-pkt/tcp-stream to intro Signed-off-by: jason taylor --- doc/userguide/rules/intro.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/doc/userguide/rules/intro.rst b/doc/userguide/rules/intro.rst index 11ab0f890f..c3522d3572 100644 --- a/doc/userguide/rules/intro.rst +++ b/doc/userguide/rules/intro.rst @@ -70,6 +70,11 @@ concerns. You can choose between four basic protocols: * icmp * ip (ip stands for 'all' or 'any') +There are a couple of additional TCP related protocol options: + +* tcp-pkt (for matching content in individual tcp packets) +* tcp-stream (for matching content only in a reassembled tcp stream) + There are also a few so-called application layer protocols, or layer 7 protocols you can pick from. These are: