Reguła snort'a:
alert tcp any any -> <moja sieć> (content: "abcd"; length: 1234; distance: 30)