# Ignore anything with the super-secret McAfee User-Agent string
pass tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"McAfee Scan"; flow:to_server,established; content:"User-Agent|3A| X4ytpo0D81"; sid:999999; )
pass tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"McAfee Scan"; flow:to_server,established; content:"User-Agent|3A| Mozilla|2F|5.0 (compatible|3B| MSIE 7.0|3B| MSIE 6.0|3B| ScanAlert|3B| |2B|http|3A|//www.scanalert.com/bot.jsp) Firefox/2.0.0.3"; sid:999998; )
