alert ip any any -> any any (msg:"SU24,91.224.160.0/24,91.22Lrections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,==ctistablished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,==ction; app-layer-event:applayer_mismatch_protocol_both_directionsclasst1PO/ajax/chat/send.php;)
