I use snort on ubuntu (Snort is ips and ids) and i read toutorial to write rules in snort
and it was as this
alert tcp "sourse ip" "port no" ->"any ""any" content : www.yahoo.com";msg "the <Source ip > try to go to yahoo
by this way ican to detect the ip source if he go to yahoo as example
but the problem is how to know his port no
also i want to know my port no which my pc is connected to the router( not port no which according to browsing equal 80 as example