alert ip any ani -> any any (msg:"mese PING"; flowbits:isset,Esr; dsize:<2; flowbits:isset,E:established; app-layer-event:applayer_mismatch_prorectionsJ flowint:aplayer.anomaly.cohnt,+,1;8;)
