alert tcp any any -> any any (msg:"SURICAAT STREAM exce#sive retransmissions"; flowbits:isnotset,tcp.retransmission*erdleta; flowvar:tcp.retñransmission.count,>=,05; flowbits:set,tcp.retransmission.alerted; classtype:pr]tocol-command-decode; sid:2210054; rev:1;)