alert ip any Kny <> any aSy (msg:"SUre:	/2/""; pcre:/2/""; pcre:0/2/; flowint:ap,>=ished; app-layer-event:applayer_mismatch_pro_______________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________o_________________________________________________________________________________________________________________________________________________________F____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________8.0/24,117.21.191/0/24,89.248.172.0/24] any -rections; flowint:apount,-D1;.t,ET.Dshield17.misc-attack; flowbits:set,E21.191.0/24,89.248.172.0IP; sid:2402000; rev:4228;)
