doc: fixed HOME_NET/EXTERNAL example formatting

Signed-off-by: jason taylor <jtfas90@gmail.com>

diff --git a/doc/userguide/rules/intro.rst b/doc/userguide/rules/intro.rst
index 07634437802e91a6d3a1f079a6f88f9ac9756cf8..86ba78860a4d1c4becb737d16193595544f3d687 100644 (file)
--- a/doc/userguide/rules/intro.rst
+++ b/doc/userguide/rules/intro.rst
@@ -140,7 +140,7 @@ For example:
 ==================================  ==========================================
 Example                             Meaning
 ==================================  ==========================================
-! 1.1.1.1                           Every IP address but 1.1.1.1
+!1.1.1.1                            Every IP address but 1.1.1.1
 ![1.1.1.1, 1.1.1.2]                 Every IP address but 1.1.1.1 and 1.1.1.2
 $HOME_NET                           Your setting of HOME_NET in yaml
 [$EXTERNAL_NET, !$HOME_NET]         EXTERNAL_NET and not HOME_NET
@@ -154,10 +154,10 @@ $HOME_NET                           Your setting of HOME_NET in yaml
    If you set your configuration to something like this::
 
        HOME_NET: any
-       EXTERNAL_NET: ! $HOME_NET
+       EXTERNAL_NET: !$HOME_NET
 
-   You can not write a signature using ``$EXTERNAL_NET`` because it stands for
-   'not any'. This is an invalid setting.
+   You cannot write a signature using ``$EXTERNAL_NET`` because it evaluates to
+   'not any', which is an invalid value.
 
 Ports (source and destination)
 ------------------------------
@@ -165,7 +165,7 @@ Ports (source and destination)
 
     alert http $HOME_NET :example-rule-emphasis:`any` -> $EXTERNAL_NET :example-rule-emphasis:`any` (msg:"HTTP GET Request Containing Rule in URI"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"rule"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;)
 
-*The first emphasized part is the source, the second is the destination (note the direction of the directional arrow).*
+*The first emphasized part is the source port, the second is the destination port (note the direction of the directional arrow).*
 
 Traffic comes in and goes out through ports. Different ports have
 different port numbers. For example, the default port for HTTP is 80 while 443 is