Some questions about snort rules, specifically "content" option

["Sitao \"Tony\" Cheng via Snort-sigs" <snort-sigs () lists snort org>]

Hello,
   I am a developer using snort to build a NGFW. It is really helpful.
   I have some questions about snort which might be caused by versions differences. On snort manual, it is 
said that there can be several ??content?? options. However, when I wrote a rule with two ??content?? options and tried 
to display the port group related to that option tree node, I found that only one content is displayed. I made sure 
that the two "content" options are set inside the option tree node. After digging into the code, I found that only one 
??content?? option is selected from that option tree node. I wonder that is it a new way of creating a port group or a 
new way of writing rules? If so, how should I write a suitable rule? The information on the Internet is all about the 
old version which is a little bit confusing.
   I would appreciate it so much for your time and help.

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!