title: Snort rule to verify content of an http request doesnt work
body: <p>I am trying to verify the contents of the http response to find a content "abbb" in it.So my rule was </p>
  
  <p>alert tcp MY_SERVER HTTP_PORTS -> any any(msg:"The page accessed has content abbb";to_client; established; content:"abb";sid:XXXXX; rev:x;)</p>
  
  <p>unfortunately this rule seems not to work. Can anyone please tell if there is some issue with my rule.</p>