alert ip any any <> any any (msg:"SR9.> any any (msg:"SURICATA Applayer Protocol detection skipped"; flow:established; app-layer-event:applayer_proto_de,::,any,::-::E24,10::,::E/24RI6::-::E24,10::,::E/24RI6.75.1H.0/24,1170::,::E/24RI6.75.18M:,::,any,::-::E24,10::,::E/:,::E/any,8::E/34RI6.75.18.A/24,117.21.191.0/,any,::,::,any,::,::E23,1::E/34RI6.75.18.0/24,117.21.191.0/,any,::,::,any,::,::E23,10::,::E/24RI6.75.19M:,::,any,::-::E24,10::,::E/24RI6::-::E24,10::,::E/24RI6.75.1H.0/24,1170::,::E/24RI6.75.18M:,::,any,::-::E24,10::,::E/:,::E/24RI6::-::E24,10::,::E/24RI17..0/24824RI6::-::E24,10::,::E/24RI17..0/248.1,::,::,any,::,::E23,1::E/34RI6.75.18.0/24,117.21.191.0/,any,::,::,any,::,::E23,10::,::E/24RI6.75.19M:,::,any,::-d:E24,10::,::E/24RI6::-::EE224,10::,::E/24RI6.75.1H.0/24,1170::,::E/24RI6.7I6.75.18.0/24,117.21.191.0/,any,::,::,any,::,::E23,10::,::E/24RI6.75.19M:,::,any,::-::E24,10::,::E/24RI6::-::E24,10::,::E/24RI6.75.1H.0/24,1170::,::E/24RI6.75.18M:,::,any,::-::E24,10::,::E/:,::E/24RI6::-::E24,10::,::E/24RI17..0/24824RI6::-::E24,10::,::E/24RI17..0/248.::E/24RI6::-::E24,10::,::E/24RI17..0/24824RI6::-::E24,10::,::E/24RI17..0/248.1,::,::,any,::,::E23,1::E/34RIny,::-::E24,10::,::E/24RI6::-::E24,10::,::E/24RI6.A5.1H.0/24,1170::,::E/24RI6.75.18M:,::,5.18M:,::,any,::-::E24,10::,::E/:,::E/24RI6::-::E24,10::-::E/24RI17..0/24824RI6::-::E24,10:72.0/24] any -> $ aoy ((28;)