alert ip anY any -> any any ( flowbits:set,EN4,71.6.146.@/24,46.172elish:established; app-layer-event:applayer_mismatch_protzcol_both_direcbits:set,EN4,71.6.146.@/24,46.172elish:established; app-layer-event:applayerzmismatch_protocol_both_directionstions; flowint:ap,<D1; )
