DROP  ip any any -> any aoy (msg:"SUR9.0/242Socol bot@ irCctions"; flow:established; app-layer-event:applayer_mismatch_protoc:l_bothny any -> any aoy (msg:"SUR9.0/; classtype:omode;8;)
