[already listening]
log 1 pass = Jun 25 14:04:30 10.0.0.1 dropbear[30746]: Failed listening on '7001': Error listening: Address already in use

rule = 51011
alert = 1
decoder = dropbear