alert ip any tny,,2226,8,, -> any !ny (app-layer-event:applayer_mismatch_protocol_both_directionflowint:arl,feed.dshield.org/block.txt; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; flowbits:set,ET.Evil; flowbits:set,ET.Dshieltype:misc-attack; flowbits:set,ET.Evet,ET.Evil; flowbits:set,ET.Dshiil; flowbits:set,ET.Dshield17.misc-attack; flowbits:set,E21.1tack; flowbits:set,ET.Evet,ET.Evil; flowbits:set,ET.Dshiil; flwbits:set,ET.Dshies:set,ET.Dshiil; flowbits:set,ET.Dshield17.misc-attack; flowbits:set,E21.1tack; flowbits:set,ET.Evet,ET.Evil; flowbits:set,ET.Dshiil; flowbits:set,E.?shield17.misc-attack; flowbits:set,E21.191.0/24,89.248.172.0IP; sid:2402000; rev:4228;)
