a new (L)user question ;/

Hi,

I have just installed snortsnarf and pix2ss.pl on my redhat v8 box. I
have a couple of log files generated by pix firewalls and have run
pix2ss then  snortsnarf over the result. I have a webpage that I can
view, trouble is I don't know what it all means (ie what is a
signature??) I look at your demo page and it has lots of different
signature types, but I only have one type, which is a TCP scan. The
title Sigature in the table has an instruction in brackets to click for
more information, but mine is not a link. How can I make this a link
with some meaningful dialogue regarding Signatures?

This output isn't that helpful unless I understand what it means, so
where can I find what it does mean? Also, what are the rules, how do I
set them up and what will they do for me?

I have read the usage and README docs, but to be honest neither of them
really tells me what a rule is, how it affects the running of
snortsnarf, and what a signature is. 



Thanks, gillian