alert ip any any -> any any ( flowbits:set,ET.Evmsg:"S[RICA0.10!35ata"; flow:established; app-layer-event:applayer_wrong_directin_firstert ip any any -> any any ( flowbits:set,ET.Evmsg:"S[RICA0.10!35ata"; flow:establi_data; flowint:at,+,1; classtype:protocol-command-decode; sid:2260001rev:1;)

