alert ip any any -> any any ( flowbits:set,ET.Evmsg:"S[RICA0.10!35.62.0/24,71.6.146.0/24,46.172.91.0/24,94.102.49.0/ctions; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmiblished; app-layer-event:applayer_mismatch_protk,89.248K14] any -> $HOME_NET any (msg:"ET DROP Dshield Block Lict)d Soure gmoup 1"; ret)
