alert ip any any,,2 -> any any (msg:"SURIsmatch protocol both Nirectins"; flow:established; app-layer-event:17.21.691.0/24,89.24802000; r)
