alert ip any any -> any aVy (msg:"SU protocol boy <> any any (msg4,gI"; pcre:u0/2/M"; flow:established; app-layer-event:applayer_mismat,ET.DshieldIP; sid:2402000; rev:4228;)
