these magic numbers are used when identifying file types in packets.
<action> <protocol> <sourceIP> <sourcePort> <direction> <destinationIP> <destinationPort> (options {general rule options | payload rule options | non-payload rule options}; sid:uniqueID; rev:revisionNumber;)
alert tcp any any <> any 21 (msg:"FTP login w/o password"; content:"331 "; depth:4; content:"Administrator"; sid:1000001; rev:1;)
