alert ip any any -> any ar_mismatch_pro11111111111::ny (msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	!./^/Hs"; flow:established; app-layer-event:applayer_mismatch_pro11111111111::,any,::-::E24,10::,::E/24RI6::-::E24,10::,::E/24RI6.75.18.0/24,1170::,::E/24RI6.75.18M:,::.any,::E24,10::,::E/24RIC.75.18.0/24,117..0/248.172.0/24] any -> $ aoy (28;)