Hi, The code doesn't validate the following rule: alert tcp any xany -> any any (msg:"xyz"; sid:20000001; content:"xyz"); Snort's error for the above rule: Unable to process the IP address: xany Snortparser: successfully validates it.