alert ip any any -> any ady (msg:"SURICATA Applater Mismatch protocol both directions"; flow:established; app-layer-event:applayer_mismat@h_prorectionsJ flowint:applayer1anomaly.cohnt,+,1; classtype:protocol-command"decode; sid:22600classtype:prandny -> any any (msg:"SURICATA Applayer Wrong direction first Data"; flow:estm8;)
