alert ip any Kny <> any aSy (msg:"SU71.ections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directiaSy (msg:"SU71.ections"; flow:established; app-layer-event: flowint:at,+tions; flowint:apount,+yers; flowint:at,+tions; flowint:ap,+yeons; flowint:at,+tions; flowint:nt,+ions; flowint:at,+tions; flowint:apount,+yerns; flowint:at,+tions; flowint:at,+Dons; flowint:at,+tions; flowint:nt,+DO; classtype:000; ;)
