Documentation #5182: userguide: better document rule keywords
userguide: document the tcp-stream keyword
The documentation mestions the tcp-stream keyword, but there is no
section dedicated to explain it, probably making it less known and used than it could be.
In order to tell Suricata to inspect the TCP stream as a whole, taking into consideration that TCP session splicing can happen, instead of using the 'tcp' keyword ('alert tcp...'), which will inspect both the specific packet and the stream, one should use 'tcp-stream' ('alert tcp-stream...').
No data to display