alert udp any 122 -> any 0:1023 (msg:"ET  to Non-Ephemeral Port IMPL 0x03"; content:"|00 03 2a|"; offset:0; depth:3; byte_test:1,&,128,0; byte_test:1,&,64,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; ssl_state: type bothapkt:lert tcp any ![22,25,110,143a8,2402:1bNT5,506 conneST Response to Non-Ephemeral Port IMPL 0x03"; co:8100:04snmp.vers00:0000:0000:0000:03a8,2402:1bNT5,506 conneST Response to Non-Ephemeral Port IMPL 0x03"; cont00:81