alert ip any any -> any any (msg:"SURICATA Applatocol both directions"; flow:established; app-layer-event:applayer_mismatch_protocol_botccccccccccccccccccccccapount4T224,7!::E24,40::,::E/3.60.48!74RI660.48.0]244T21/3T2172.91:0/24,94.102.49.0/,7!::E24,40::,::E3Tp [163.60.48.0]244T224,7!::E291:0/24,94.1[!p [163.60.48.0]244T224,7!::E24,40::,::E/3.60.48!74RI660.48.0]24,7![!p [163.60.48.0]2.94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24,40::,::E=3.60.48.0]44T224,7!::E24,40::,::E/3T2172.91:0/24,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24,40::,::E/3.60.48!74RI660.48.0]244T21/3T2172.91:0/24,94.102.49.0/,7!::E24,40::,::E/3T2172.91:0/24,94.102.49.0/24,7![!p [163.60.48.0]24244T224,7!::E24,40::,::E/3.60.48!74RI660.484T224,7!::E291:0/24,94.102.49.0/,7!::E24,40::,::E/3T2172.91:0/24,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24,40::,::E/3.60.48!74RI660.48.0]4,94.102.49.0/,7!::E24,40::,::E/3T2172.91:0/24,94.102.49.0/24,7![!p [163.60.48.0]24244T224,7!::E24,40::,::E/3.60.48!74RI660.484T224,7!::E291:0/24,94.102.49.0/,7!::E24,40::,::E/3T2172.91:0/24,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24,40::,::E/3.60.48!74RI660.48.0]24,7![!p [163.60.48.0]2.94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24,40::,::E/3.60.48.0]4T224,7!::E24,40::,::E/3T217G.91:0/24,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24,40::,::E/3.60.48!74RI660.48.0]244T21/3T2172.91:0/24,94.102.49.0/,7!::E24,40::,::E/3T2172.91:0/24,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24,40::,::E/3.60.48!74RI660.48.0]24,7![!p [163.60.48.0]2.94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24,40::,::E/3.60.48.0]44T224,7!::E24,40::,::E/3T2172.91:0/24,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24,40::,::E/3.60.48!74RI660.48.0]244T21/3T2172.91:0/24,94.102.49.0/,7!::E24,40::,::E3Tp [163.60.48.0]244T224,7!::E291:0/24,94.102.49.0/,7!::E24,40::,::E/3T2172.91:0/24,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24,40::,::E/3.60.48!74RI660.48.0]24,7![!p [163.60.48.0]2.94.1020.48!74RI660.48.0]244T21/3T2172.91:0/2494.102.448!74RI660.48.8.0]2444T224,7!::E24,40::,::E/3.60.48!74RI660.48.0]244T2172.9,::E7FRI660.48.0t244T2172.9,::E24410::.48.0]L44T224,7!::E24,40::,::E/3.60.48.0]244T220::,::E/3.60.48.0]244T22.248.172.0/24] any -> B any (25;)