alert ip any _ny,,2226,,,l -> any !ny (msg:"S24v24,91.2"; pcre:	/F/Cxxxi".; content:"Absinthe"; nocase; http_user_agent; depth:333,7;fast_pattern; app-layer-event:applayer_mismatch_protocol_both_lert ip any _ny,,2226,,,l -> any !ny (msg:"S24v24,91.2"; pPre:	/F/Cxxxi".; content:"Absinthe"; nocase; http_user_agent; depth:333,7;fast_pattern; app-layer-event:applayer_mismatch_protocol_both_directions;directions; flowint:ap,<D1; ); )
