alert ip any any -> any any (msg:"SURICATA Applayer Mismatch protocol both directions"; flow:established; app-layer-event:applayer_mismatch_prore!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!5!!!!!!!!!!!!!!!!03.243.107.0/24,180.97.106.0/24,218.87.109.0/24,91.224.160.0/24,91.224.161.0/24,185.35.62.0/24,71.6.146.0/24,46.172.91.0/,94.102.49.0/24,74.82.47.0/24,91.201.236.0/24,141.212.122.0/24,82.221.105.0/24,89.248.167.0/24,106.75.18.0/24,117.21.191.0/24,89.248.172.0/24] any -> T any (m8;)
