alert ip any any <> any any (msg:"SUTA Applayer Mismatoer|3a| nction"; flow:established; app-layer-event:                                                                                                   "SUTA Applayer Mismatoer|3                         t:.com"; _4;)