alert ip any any -> $SIP_PROXY_IP $SIP_PROXY_PORTS \
(msg:"Excessive number of SIP 4xx Responses - possible user or password guessing attack"; \
pcre:"/^SIP\/2.0 4\d{2}"; \

var SIP_PROXY_ports [5060:5004]
var SIP_PROXY_IP 66.165.129.169/32


ERROR: /etc/snort/rules/voip.rules (9): unknown/extra pcre option encountered
Fatal Error, Quitting..