id

The id rule option is used to check an IP header's identification (ID) field value is less than, greater than, equal to, not equal to, less than or equal to, or greater than or equal to a specified integer value. This rule option can also check that the header's ID value is between a range of numbers, using the <> range operator for an exclusive range check or the <=> range operator for an inclusive one.

Format:

Single value comparison

id:[<|>|=|!|<=|>=]id;

Range comparison

id:id_min{<>|<=>}id_max;

Examples:

# Check for an ID value that equals 31337
id:31337;

# Check for an ID value that is greater than 31337
id:>31337;