diff --git a/doc/userguide/rules/header-keywords.rst b/doc/userguide/rules/header-keywords.rst index f407af7f05..5e4e3f994a 100644 --- a/doc/userguide/rules/header-keywords.rst +++ b/doc/userguide/rules/header-keywords.rst @@ -643,6 +643,11 @@ Example of icmp_seq in a rule: alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL SCAN Broadscan Smurf Scanner"; dsize:4; icmp_id:0; :example-rule-emphasis:`icmp_seq:0;` itype:8; classtype:attempted-recon; sid:2100478; rev:4;) +icmpv4.hdr +^^^^^^^^^^ + +Sitcky buffer to match on the whole ICMPv4 header. + icmpv6.hdr ^^^^^^^^^^