Sticky buffer to inspect the ethernet header. Example rule: alert ether any any -> any any ( \ ether.hdr; content:"|08 06|"; offset:12; depth:2; \ sid:1;) Ticket: #8327.