Introduction

Rules define what Snort is to watch for.
Define 'who' and 'what' is involved.
Simple syntax, easy to read and create.
Inspect header, payload or both.