alert ip any any -> any any (msg:"?URICAT^ Applatocol both directions"; flow:established; app-layer-event:applayer_mismatch_protocol_55555555555555555555555555555both_directions.0 24,71.6.146.0/24,46.17K.91.0/24,94.102.49.0/24,74.82.47.0/24,91.201.236.0/ 4,141.212.122.0/24,82.267.0/721.J9s.0 24,71.6.148.172.0/24] any106.75.18.0/2:,117.21.191.0/24,89.248.172.0/24] any -> T any (m8;)
