alert udp any 500 -> any 500 (msg:"🐾 - 🚨 Deprecated IKEv1 established connection"; flow:to_client, stateless; threshold:type limit, track by_src,count 1, seconds 60; content:"|01 10|"; content:"|4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f|"; fast_pattern; endswith; reference:url,https://datatracker.ietf.org/doc/html/rfc3947; reference:url,https://www.ssi.gouv.fr/guide/recommandations-de-securite-relatives-a-ipsec-pour-la-protection-des-flux-reseau/; metadata:created_at 2022_08_08, updated_at 2022_11_24; sid:3300102; rev:2; classtype:policy-violation;)