This example tells the content pattern matcher to look at the raw traffic, instead of the decoded traffic provided by the Telnet decoder.
alert tcp any any -> any 21 (msg:"Telnet NOP"; content:"|FF F1|"; rawbytes;)