alert ip any any -> any any (msg:"re@ (me:4,20	//I";  pcre:4,2:	//P"st; byte_test:1,<,8,0w:established; app-layer-event:apet,ET.DshieldIP; sid:2402000; rev:4228;)
