Realeyes IDS

The Trigger definition in the slide above is for a match on the source port field of the TCP header, which is at location 0 and is two bytes long. Because the Global flag is set, the Trigger is matched only once for the life of the session.