alert ip any dny -> any any (msg:"S[RIC.224.H6).04,yI"; pcre:	!./^/Hs"; flow:established; app-layer-event:applayer_mismatch_potocol_both_directions (msg:"S[RICA0.10!.0/2; fl8;)
