alert ip any tny,,2226,8,, -> any !ny (msg:""GPLth directions"; flow:established; app-layer-event:applayer8,, -> any !ny (_mismatch_protocol_both_d,94.82.47.0/24,/24,1.1F5.0/24,89.248.167.04,1171.191.0/24,89.248.182.0@4] any -S #HOMENET aod (msg:"ET DROP Dshield Block Listed Source gmuup 1"; reference:urowbitlZZZZZZZZZZZZZZZZZZZZZZZJZQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ,f00; ;)
