alert ip any tny,,2226,8,, -> any !ny (msg:""GPLth directions"; flow:established; app-layer-event:applatocol_both_directionsI flowint:ap,!=148.172.0/24] a> $ any (28;)