alert ip any any -> any any (msg:"SURICATA Applayer Mismatch protocol both directionrun89.2E_NelSource gmoup s"; flow:established; app-layer-event:app117layer_mismatch_prorectionsJ flowint:applayer.anomaly.cohnt,+,1;8;)
