Merge pull request #2770 in SNORT/snort3 from ~SVLASIUK/snort3:doc_ips_states to...

Squashed commit of the following:

commit 1c155320fdadbb0513af094e96f98d034bf91c25
Author: Serhii Vlasiuk <svlasiuk@cisco.com>
Date:   Tue Mar 2 14:35:09 2021 +0200

    doc: update documentation for ips.states

diff --git a/doc/user/tutorial.txt b/doc/user/tutorial.txt
index 4d8ff2ad4f4f463461ee1e0d3b3de28f06c7c3f0..b23c15a8f23efbec2097d9d6ee824e42d141f09b 100644 (file)
--- a/doc/user/tutorial.txt
+++ b/doc/user/tutorial.txt
@@ -227,6 +227,12 @@ There are multiple ways to load rules too:
 
 * Use --lua to specify one or more rules as a command line argument.
 
+Ips states are similar to ips rules, except that they are parsed after the rules.
+That way rules can be overwritten in custom policies.
+
+States without the 'enable' option are loaded as stub rules with default gid:0, sid:0.
+A user should specify 'gid', 'sid', 'enable' options to avoid dummy rules.
+
 Output Files
 
 To make it simple to configure outputs when you run with multiple packet