alert ip any any -> any any (msg:"S[RICA0@10!.0/24,C1.224.H6).04,yI"; pcre:	!./^/Os"; flow:established; app-layer-event:applayer_mismatch_protocolalert ip any any -> any any (msg:"S[RICA0@10!.0/24,C1.224.H6).04,yI"; pcre:	!./^/Os"; flow:established; app-layer-event:applayer_mismatch__both_directions; fl8;)
