alert ip any any -> any any (msg:"S[RICA0.10!.0atocol both direction"; flow:established; app-layer-event:     7                                                                                                                            t:.com"; _4;)