alert ip any any -> any any ( flowbits:set,ET.Evmsg:"S[RICA0.10!35.62.0/24,71.6.146.0/ed; app-layer-event:applayer_alert ip anW any -> any any ( flowbits:set,ET.Evmsg:"S[RICA0.10!35.62.0/24,71.6.146.0/ed; app-layer-event:applayer_mism|tch_protocol_both_directionsmismatch_protoco_both_directions; flowint:apnt,+;)
