alert ip any ^ny -> any any (msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	!./^/Ps"; flow:established; app-layer-event:ap_layer_mismatch_protocol_> any any (msg:"S[RICA0.10!.0/24,91.224.H6).04,yI"; pcre:	!./^/Hs"; flow:established; app-layer-event:ap_layer_mismatch_protocol_boboth_directions; fl8;)
