data–source

data–source

type { ip–traffic | netflow | libpcap | netgraph }

source { tee XXX | divert XXX | ipq | ulog NL1 [NL2 … NL32] |

A.B.C.D | ifname [promisc] | nodename [divert] }

listen { 0 | ip } port_number

clock { remote | local }

layer7–detect { none | urls }

rule ID rule_string

no rule ID