[SOLVED] Which part of the attack signatures (SNORT Rules) is compared with the input IPV4 packet to know it is an attack or not?

[MSAKARIM]

In the Intrusion Detection System (Network-based).
Which part of the attack signatures (SNORT Rules) is compared with the input IPV4 packet to know it is an attack or not

 

[finlay31]

Yes. I do have the same doubt. Can anyone help?

 

[MSAKARIM]

Yes. I do have the same doubt. Can anyone help?

I found it, the "content" part of the rule is compared with each part in the payload.