alert ip any any -> any any (msg:"re:4,2pcre:4,2:	//I"; pcre:4,2:	/^/V"Uth directions"; flow:established; app-layer-event:applayer_mismatch_prorectionsJ flowint:applayer:Nnomaly.cohnt,+,1;8;)
