alert ip any !ky -> any any (msg:"SUMTP Platocol both dith directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_dir,::E74RI66:-::E24,10::,:6E/24^I6.724,117.21.191.0/24,89.248.172.0/24] any -> $ any (25;)