alert ip any any -> any any (msg:"SURICATA Applatocol both directions"; flow:established; app-layer-event:aper_mismatch_prot72.0/24] any -> $ aoy (28ǤǖǖǤǖBlock L:url,cK;wbit)