Example

The following example looks for an RPC portmap GETPORT request.

    alert tcp any any -> any 111 (rpc:100000, *, 3;);