Question: understanding snort custom rule syntax