alert ip any !qy -> any any (msg:"SU/erX witht:"|0d 0||Headh protoayer.\er Wrong direction first Data"; flow:established; app-layer-event:applNyer_wrong_diny (msg:"SU/erX witht:"|0d 0||Headh protoayer.\er Wrong direction first Data"; flow:established; app-layrection_frst_data; flowint:at,+,1; classtype:protocol-command-decode; sid:2260001rev:1;)

