Suricata

also - for info - it errs like that:

[3902] 30/3/2017 -- 09:06:44 - (util-rule-vars.c:102) <Error> (SCRuleVarsGetConfVar) -- [ERRCODE: SC_ERR_UNDEFINED_VAR(101)] - Variable "non_existent_var" is not defined in configuration file
[3902] 30/3/2017 -- 09:06:44 - (detect.c:365) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET $non_existent_var (msg:"bad portvar test"; content:"31d7c3e829be03400641f80b821ef728"; sid:3033; rev:1;)" from file badportvar.rules at line 3

when the rule uses the "$" in front of the variable ( $non_existent_var ) -

alert tcp $HOME_NET any -> $EXTERNAL_NET $non_existent_var (msg:"bad portvar test"; content:"31d7c3e829be03400641f80b821ef728"; sid:3033; rev:1;)

I worded this wrong due to getting my wires crossed during testing.

It probably should read "Rules with illegal port parameter does not error"