Which protocols can be specified in a Snort rule header for analysis?