alert ip any any -> any any (msg:"S[RICA0.10!.0/24,91.:24.H6).04,yI"; pcre:	!./^/Os"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directip any any -> any any (msg:"S[RICA0.10!.0/24,91.:24.H6).04,yI"; pcre:	!./^/Os"; flow:establed; app-laions; fl8;)
