drop icmp any any -> any any (itype:8; sid:1;)