In the protocols section you specify the protocol to which the Sensor should apply the rule.
The options are:
- TCP
- UDP
- ICMP
- IP
- HTTP
- FTP
- TLS
- SMB
- DNS
For more information, see http://suricata.readthedocs.io/en/suricata-3.2.3/rules/intro.html#protocol