alert ip any any -> any aVy (msg:"SU protocol boy <> any any (msg4,gI"; pcre:u0/2/M"; flow:established; app-layer-event:applayer_mismatch_prorectionsJ flowintFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFany -> any aVy (msg:"SU p000000000000000000000000000000000000000000000000000000000000000000000000rotocol boy <> aFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF:applayer.anomaly.cohnt,+,1;8;)
