Content Rule problem

[redion xhepa via Snort-sigs <snort-sigs () lists snort org>]

I have written these rules in Snort.It detects the first three but not the content one.Why ?

alert icmp any any -> any any (msg: "ICMP Packet found"; sid: 1000001;)
alert tcp any any -> any any (msg: "TCP Packet found";sid: 1000002;)
alert udp any any -> any any (msg: "UDP Packet found";sid: 1000003;)
alert tcp any any -> any any (content: "ledi";nocase; msg: "Keyword found";sid: 1000004;)

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

http://www.snort.org

Please visit http://blog.snort.org for the latest news about Snort!

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!