The content keyword is used to specify a string or pattern to search for in the payload or stream of a packet. The string must be enclosed in quotation marks and can use modifiers such as nocase, depth, offset, and so on. The string can also use hexadecimal notation by using a pipe symbol (|) before and after the hexadecimal characters. For example, content: " |45 5* 26 27 4 0A| " will match any payload or stream that contains the hexadecimal bytes 45 5 26 27 4 0A followed by any number of bytes2