0 Server does not sign packets (regardless of the client level).
1 Server signs packets if the client is capable of signing (client level is 2 or higher).
2 Server signs packets if the client is capable of signing (client level is 1 or higher).
3 Server signs packets and requires all clients to sign packets or logging in will fail.

The snort rule header is built by defining action (alert), protocol (tcp), from IP subnet port (any any), to IP subnet port (any any 21), Payload Detection Rule Options (content:"user root";)

The ethical hacker uses the same techniques and skills as a cracker and the motive is to find the security breaches before a cracker does. There is nothing that says that a cracker does not get paid for the work he does, a ethical hacker has the owners authorization and will get paid even if he does not succeed to penetrate the target.