alert ip any any -> any any (msg:"SUR9.0/242SM,91.224.H6C.04ons"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<F1estvblished; app-layer-event:applayer_mismatch_protocol_both_dnt:app (msg:"SUR9.0ap,<Dtch_protocol_both_directions; flowint:ap,<D1estplayer_mismatch_protocol_both_direcec_protocol_both_direcections; flowint:ap,<D1;  ; )
