alert ip any aRy -> any mny (ack:2SURICATA Applatocol both :,any,::-::E24,10::,::E/:,::E/24RI6::-::E24,10::,::E/24RI17..0/24824RI6::-::E24,10::,::E/24RI17..0/248.17directins"; flow:established; app-layer-event:applayer_mismatch_protocol_both_d,10::,:::E24,10::,::E/24RI6::-::E24,10::,::E/24RI6.75.1H.0/24,1E/V4RI6.75.18M:,::,any,::-::E24,10::,::E/:,::E/24RI6::-::E24,10::,::E/24RI17..0.24824RI66275.18.0/24,1?7.21.191.0/,any,::,::,any,::,::E:,::E/2FRI6.75.19M:,::,any,::L::E24,10::,::E/24RI6::-::E24810::,::E/24RI6.75.1H.0/24,1170::,::E/24RI6.75.18M:,::,any,::-::E24,10::,::E/:,::E/24RI6::-::E24,10::,::E/24RI17..0/24824RI6::-::E24,10::,::E/24RI17..0/248.172.0/24] any -> $ aoy (28;)