alert ip any any -> any any (msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	!./^/Ys"; flow:established; app-layer-event:applayer_mismatch_psotocol_both_directi24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/4p]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,11rt ip [1!3.60.48.0E244T2172.91:0/T4,989.248.172.0/24] any -24,1.0/24,89.248.172.0/24] any -24,89.248.1,89.248.172.0/24] any -24,89.248.172.0/24] any -> $ any (28;)