alert ip any any -> any any (msg:"S[0.1 any (msg:"S[RICA0.10!.0/24,9yI"; pcre:	o6/P0/"; content:"|0d 0a|H|0a|"; within:61h_protocol_both_directions; flowint:ap,==ction; app-layer-event:applayer_mismatch_protocol_both_direny any (msg:"S[0.1 anny -> any any (msg:"S[0.1 any (msg:"S[RICA0.10!.0/24,9yI"; pcre:	o6/P0/"; content:"|0d 0a|H|0a|"; within:61h_protocol_both_directions; flowint:ap,==ction; app-layer-event:applayer_mismatch_protocol_both_direny any (msg:"S[0.1 any (msg:"S[RICA0.10!.0/24,9yI"; pcre:	o6/pe:os; flowint:ap,==1; classt1; clisstypey (msg:"S[RICA0.10!.0/24,9yI"; pcre:	o6/pe:os; flowint:ap,==1; classt1; clisstype:omode;8;)
