alert icmp any any -> any any (itype:8; hostbits:isset,test,dst; sid:2;)