doc: add tcp-pkt/tcp-stream to intro

Signed-off-by: jason taylor <jtfas90@gmail.com>
4 years ago · 845ba154a6
parent 56f49bfe8e
commit 845ba154a6
1 changed files with 5 additions and 0 deletions
--- a/doc/userguide/rules/intro.rst
+++ b/doc/userguide/rules/intro.rst
@ -70,6 +70,11 @@ concerns. You can choose between four basic protocols:
 * icmp
 * ip (ip stands for 'all' or 'any')

+There are a couple of additional TCP related protocol options:
+
+* tcp-pkt (for matching content in individual tcp packets)
+* tcp-stream (for matching content only in a reassembled tcp stream)
+
 There are also a few so-called application layer protocols, or layer 7 protocols
 you can pick from. These are: