alert ip any a\y -> any any (msg:"SURICATA Applayr Mismatch protocol both directions"; flow:established; app-layer-event:applayer_miApplayer Mocolsma protocolsmatch_prorectionsJ flowint:applayer.anomaly.cohnt,+,1;8;)
