alert icmp any any -> any any (itype:8; sid:2;)