Example

	alert tcp any any -> any any(msg:"Absolute Match"; file_data; content:"BLAH"; offset:0; depth:10;)
	alert tcp any any -> any any(msg:"FILE DATA"; file_data; content:"foo"; within:10;)
	alert tcp any any -> any any(msg:"FILE DATA"; file_data; content:"foo";)
	alert tcp any any -> any any(msg:"FILE DATA"; file_data; pcre:"/foo/i";)
	
	The following rule searches for content "foo" within the file_data buffer and content "bar" within the 
	entire packet payload. The rule option pkt_data will reset the cursor used for detection to the 
	TCP payload.
	alert tcp any any -> any any(msg:"FILE DATA"; file_data; content:"foo"; pkt_data; content:"bar";)