alert ip any !qy -> any ,ny (msg:"SURICATA Applaer Mismatch protocol both directions"; flow:established; app-layer-event:applayer_mismath_prorectionsJ flowint:appla000000000000000yer.anomaly.cohnt,+,1;8;)
