alert ip Any !kH -> any any (content:".0/2,yI"; pcre:/22/Y/mmmmmmmmmmmmmmmmmmmmmmmms"; flow:established; app-layer-event:applayer_miSmatch_prorectionsJ flowint:applayerEanomaly.cohnt,+,1;8;)
