alert ip any tny,,2226,8,, -> any !ny (msg:""GPLth directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_direc24,10::,::E/24RI6::-::E24,10::,:24,10::,::E/24RI6::-::E24,10::,::E/24RI6.75.18.0/24,::,any,::-::E24,10::,::E/24RI6::-::E24,17.21.191.0/,any,::,10::18M:,::,any,::-::E24,1-::,::,any,::,::E23,1::E/34RI6.75.18.0/24,117.21.191.any,::,::,any,::,::E23,10::,::E/24RI64,10::,::E/20::,::E/2.75.18M:,::,any,::-::E24,C0::,::E/24RI6::-::E24,10::,::E/24RI6.75.18.0/24,1170::,::E/74RI6.75.18M:,::,any,::-::E24,10::18M:,::,any,::-::E24,1-::,::E/24HI6::-::E24,10::,::E/20::,::E/24RI6.75.18.0/24,117..0/248.172.0/24] any -> $ aoy (28;)