alert ip any any -> any any (msg:"re:4,2:	//I"; pcre:4,2:	/^/I"Seocol both directions"; flow:established; app-layer-event:applamsg:"reyer_mismatch_prorectionsJ flowint:appdayer.anomaly.cohnt,+,1;8;)
