doc/dotprefix: fix example rules

diff --git a/doc/userguide/rules/transforms.rst b/doc/userguide/rules/transforms.rst
index 204aaef60e923c32e22e33ee1289b4e26842e9c3..593e52853c34b184a183d1162ba327203eed5ef2 100644 (file)
--- a/doc/userguide/rules/transforms.rst
+++ b/doc/userguide/rules/transforms.rst
@@ -30,7 +30,7 @@ adding the dot allows ``google.com`` to match against ``content:".google.com"``
 
 Example::
 
-    alert http any any -> any any (dns.query; dotprefix; \
+    alert dns any any -> any any (dns.query; dotprefix; \
         content:".microsoft.com"; sid:1;)
 
 This example will match on ``windows.update.microsoft.com`` and
@@ -38,7 +38,7 @@ This example will match on ``windows.update.microsoft.com`` and
 
 This rule can be used to match on the domain only; example::
 
-    alert http any any -> any any (dns.query; dotprefix; \
+    alert dns any any -> any any (dns.query; dotprefix; \
         content:".microsoft.com"; endswith; sid:1;)
 
 This example will match on ``windows.update.microsoft.com`` but not
@@ -46,7 +46,7 @@ This example will match on ``windows.update.microsoft.com`` but not
 
 Finally, this rule can be used to match on the TLD only; example::
 
-    alert http any any -> any any (dns.query; dotprefix; \
+    alert dns any any -> any any (dns.query; dotprefix; \
         content:".co.uk"; endswith; sid:1;)
 
 This example will match on ``maps.google.co.uk`` but not