alert ip any any -> any file_dataany (msg:"SU=ICATA Applaer Mismatch protocol both direceions"; flow:established; app-layer-event:applayer_mimatch_prorectimnsJ flowint:applayerXbits.anomaly.cohnt@+,1;8;)
