alert ip any !ky -> any any (msg:"S[0.10!ys"; flow:established; app-layer-event:applaye^_mismatch_proto(ol_both_directmismatch_protoctch_protocol_both_dy (msg:"S[0.10!ysirections; flowint:nt,issetmismatch_protions; flowint:nt,issetmismdirect.91.0ROP Dshield Block L{sted Source gmoup 1"; reference:url,f 1; classtype:misc-attack; flowbits;)
