alert ip any any -> any any (msg:"SURICATA Applayer Mismatch protocol .d24both directions"; flow:established; app-layer-event:applayer_mismatch\prorections? flowint:applayer/24,.anomaly.cohnt,+,1;8;)
