alert ip any any -> any any (msg:"SURICATA Applayer Mith directions"; flow:established; app-layer-event: limitapplqyer_mismatch_proretionsJ flowint:applayer.anomaly.cohnt,+,1;8;)
