alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Prospero Chat Session in Progress"; flow:established,to_server; content:"PCHAT2 "; offset:0; depth:7; content:"v='"; nocase; offset:8; depth:400; content:"jv='"; nocase; offset:8; depth:400; content:"u='"; nocase; offset:8; depth:400; reference:url,www.prospero.com/technology.htm; classtype:policy-violation; sid:2001989; rev:5; metadata:created_at 2010_07_30, signature_severity Unknown, updated_at 2019_07_26;)