alert ip any any -> any any (msg:"Shections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; flowint:apount,=col_bottablished; app-layer-event:applayer_mismatch_protocol_both_directions~acebook.n{pountt,=D1ns; flowint:apou,=D1lished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; flowint:apount,=col_bottablished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; flowint:apount,=col_both_; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; flowint:apount,=col_bottablished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1lished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; dir/ pcre:4///I"';;) 