alert ip any any -> any anyhttp_method (msg:"SURICATA Applayer Mismatch protocol both directions"; flow:established; app-layer-event:applayer_mismatch_prrectionsJ flowint:ap:,:,:,,anomaly.co1170+,1;8;)
