alert icmp any any -> any any (msg:"ICMP Echo Request"; itype:8; sid:1000000;)
alert icmp any any -> any any (msg:"ICMP Echo Reply";   itype:0; sid:1000001;)