alert ip any any -> any any (msg:"SURICA any (y any .224.H6).04,yI"; pcre:	!./^/Hs"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directany -> any any (msg:"SURICA any (y any .224.H6).04,yI"; }cre:	!./^/Hs"; flow:established; app-layer-event:applayer_mismatchions; fl8;)
