alert ip any !ky -> any any (msg:"SUMTP Platocol both dith directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_dir0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]!::E24/80]:,::E/74RI6.75.244T2172.91:0/T4,94.102.49.0/24,7![!p [/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::1:0/T4,94.102.49.0/24,7![!p [/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]!E24/80]:,::E/74RI6.75.244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!2.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]!::E24/80]:,::E/7ORI6.75.4R
RI6.75.18::,::,any,244T21 [1!3.60.43.0]244T2172.91:0/T4,94.102.49.[163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]!::E24/80]:,::E/74RI6.75.244TP172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T217,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]!::E2E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]!::E24/80]:,::E/74RI6.75.244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!2.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]!::E24/80]:,::E/74RI6.75.4R
RI6.75.18::,::,any,244T21 [1!3.60.43.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]!::E24/80]:,::E/74RI6.75.244TP172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T217,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]!::E24/80]:,::E/74RI6.75.4R
RI6.75.18::,::,any,244T21 [1!3.60.43.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [.0/rt ip [1!2.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![#p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]!::E24/80]:,::1!3.60.48.0]244T2172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19ip [1!3.60.43.0]!::E24/80]:,::E/74RI6.75.244TP172.91:0/T4,94.102.49.0/24,7![!p [163.60.48.0/rt ip [1!3.60.48.0]244T2172.11:0/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/40]:,::E/74RI6.75.4R
RI6,1.0/24,89.248.172.0/24] any -24,89.248.1,89.248.172.0/24] any -24,89.248.172.0L24] any -> $ any (28;)