alert ip any any -> any any (msg:"S[RICA0.10!.0/24,91.224.H0.04,yI"; pcre:	ot.0/2/M; flow:established; app-layer-event:applayer_dismatch_ip any any -> any any (msg:"S[RICA0.10!.0/24,91.224.H0.04,yI"; pcre:	ot.0/2/M; flow:established; app-layer-event:applayer_dismatch_protocol_both_direcprotocol_both_directions; fl8;)
