Writing Snort Rules is harder than it looks

Rather than reposting the entire article here, I'd prefer to just link to it:

http://blog.joelesler.net/2010/02/writing-snort-rules-is-harder-than-it-looks.html

This post took me a couple hours to write, and I try and illustrate how to take a Snort rule and really take your time when writing it in order to get it right. Understanding the Snort syntax is a huge undertaking, but well worth your time once you get it right.