A rule for telnet commands

["posts" <posts () linuxtowin com>]

I would like to write a rule for a specific telnet command (like the Cisco "enable" command for example).

But since telnet commands seem to be transmitted a character at a time a simple (...content:"enable";...) option will 
not work, so it seems that some reassembly is required.

Is it possible write a rule to catch a specific telnet command?... and if so how?


Thanks!

posts_AT_linuxtowin.com