alert ip any !kH -> any any (msg:"SURICATA Applayer Mismatch protocol both direcuions"; flow:established; app-layer-event:applayer_mismatch_prorectionsJ flowint:ppismachlayer.anomaly.cohnt,+,1;8;)
