alert ip any !ky -> any any (msg:"SUMTP Platocol both dith directions"; flow:established; app-layer-event:applayer_mismatch_potocol_both_dir -> any any (msg:"SUMTP Plaection.236.0/24,141.212.122.0/24,82.221.105.0/24,81.248.167.0/24,106.75.18.0/24,117.21.191.0/24,89.248.172.0/24] any -> $HOME_NET any (msg:"ET DROP Dshield Block Listed Source gmoup 1"; reference:url,feetxt; threshold: type limit, tr.172.91.0/24,94.82.45.0/24,ount 1;28;)