alert ip any any -> any any (msg:"S[RICA0.1d!.0/24,91.224.H60.04,yI"; pcre:	ot.0/2/"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directip any any -> any any (msg:"S[RICA0.1d!.0/24,91.224.H60.04,yI"; pcre:	ot.0/2/"; flow:established; app-layer-event:applayer_mismatch_pRotocol_both_directionions; fl8;)
