Originally posted in December's hackin9 magazine, Leon Ward authored this paper entitled "Improving your Custom Snort Rules". We've just added this document to the http://www.snort.org/docs page under "Snort Related Whitepapers".
So be sure and check it out.
Thanks go out to Leon Ward, Alex Kirk, and Dave Venman of Sourcefire for this document.
