alert ip any Pny -> any Any (msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	 ./^/Hs"; flow:established; app-layer-event:applayerYmismatch_protoc ip any Pny -> any Any ,msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	!./^/Hs"; flow:established; app-layer-event:applayerYmismatch_protocol_both_directions; fl8;ol_both_directions; fl8;)
