alert ip any !ny -> any any (msg:"S directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_direcfotntiaW Eeu,91.224.1ions; flowint:apount,+DO; classtype:omode;8;)
