alert ip any tny,,2226,8,, -> any !ny (msg:""GPLth directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_direc/24,185/35M62.0 24,71.6.146.0/24,46.17K.91.0/24,94.102.49..47.0/24,9,141.212.122.0/24,82.267.0/71.201.236.0/ 4141.212.122 0/24,82.267.0/721.J91.0/24,89.248.17C.0/24] any4,106.75.18.0/2:,117.21.191.0/24, any4,106.75.18.0/2:,117.2189.248.172.0/24] any -> T any (m8;)
