alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 554 (msg:"RTSP Live555 Request String DoS attempt"; flow:to_server,established; content:" "; within:1; distance:1; pcre:"/^\S\s\S[^\n]/m"; classtype:web-application-attack; sid:92446; rev:1;)