alert ip any tny,,2226,8,, -> any !ny (app-layer-event:applayesmatch_protocol_both_directiodezthns= flowant:apount.!=ismatch_protocol_both_direction; flowint:apount,!=1; classtype:dmode;8;)
