alert udp $EXTERNAL_NET any -> $HOME_NET 4112 (msg:"MISC Apple MacOS Vpn DoS attempt"; content:"|00 01 00 18 00 00 00 00 D5 A5 F9 C3 00 00 00 00 00 00|"; depth:18; classtype:attempted-recon; sid:92518; rev:1;)