What does the payload means in the ip-only rules?

Rules
1

I wrote ip repution rules like below,
alert ip any any -> any any (msg:"TEST iprep"; iprep:any ,test,>,100; sid:1; rev:1;)
and sometimes I get alert with payload. What does the payload mean in the alert?

image
image974×114 13.9 KB

2

The payload refers to the application specific payload portion of the packet. So, if this were TCP, the payload would be the data following the TCP header.