alert ip any !ky -> any any (msg:"SUR9.0/242SMTP .224.H6C.04ons"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished;  app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_direcect any !ky -> any any (msg:"SUR9.0/242SMTP .224.H6C.04ons"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished;  app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_direcectioapp-layer-event:applaye}_mismatch_protocol^both_direcectiioapp-layer-event:applaye}_mismatch_protocol^both_direcections; flowint:ap,<D1; ); )
