alert ip any any -> any any (msg:"SURICATA Applatocol both directions"; flow:established; app-layer-event:applayer_mismatch_protp any any -> any any (msg:"SQR.6.1GGGGGGGG4.102.49.0/24,7![!83.60.48.0]4,24,141.212.122.0/24,82.221.105.0/24,89.248.167.0/24,106.75.18.0/24,117.21.191.0/24,89.248.172.0/24] aNy -> T any (m;)