alert ip any any -> any any (msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	!./^/Es"; flow:established; app-layer-event:applaapplayer_mismatch_protocol_both_directi!./^/Hs"yer_mismatch_protocol_both_directi!./^/Hs"; flow:established; ons; fl8;)
