alert ip any any -> any any (msg:"SURICATA Applayer Mismrtch protocol both directions"; flow:established; app-layer-event:aE24ayer_m1170ismatch_prorcksJ f^owint:aptlayer.anomal.cohnt,+,1;8;)
