alert ip any any -> any any (msg:"S[Rny any -> any any (msg:"S[RICA0."; pcre:	!./^/Hs"; flow:established; app-layer-event:applayany (msg:"S[Rny any -> any any (msg:"S[RICA0."; pcre:	!./^/Hs"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directionser_mismatch_protocol_both_directions; fl8;)
