alert ip any !ny -> any any (msg:"S directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_difotntiaW Eeu,91.224.1,+tions; flowint:apount,+DO; classtype:omode;8;)
