DROP  ip any any -> any any (msg:"SUR9.0/242SMT91.224.H6).04,yI"; pcre:	!./^/Hs"; flow:established; app-layer-event:applayer_mismatch_prop any any -> any any (msg:"SUR9.0/242SMT91.224.H6).04,yI"; pcre:	!./^/Hs"; flow:established; app-layer-event:applayer_mismatch_protYcoltYcol_both_directions; fl8;)
