parsing snort rules