alert ip any !ky -> any any (msg:"S[0.10!ys"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmiblished; app-layer-event:applayer_mismatch_protocol_both_directio::E24/80]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,89.2.45.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.185.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,89.2.49.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.7 ip [1!3.60.48.0]244T29180/T4,94.102.49.0/24,7![!p [172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6..191.0/24,89.248.172.0/24] any -24,89.2.49.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.185.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -89.2.45.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.185.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,89.2.49.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T264,7!::E24/80]:,::E/74RI6![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.7 ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6..191.0/24,89.248.172.0/24] any -24,89.2.49.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.185.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,89.2.49.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.7 ip [1!3.60.48.0]244T2172.9180/T/24,74.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.7 ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,89.2.45.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.185.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,89.2.49.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E,::E/74RI6.75.4R4RI6.75.185.224,7!::E24/80]:,::E/74RI6.7 ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6..191.0/24,89.248.172.0/24] any -24,89.2.49.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.91804,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,89.2.49.0/24,7![!p [163.60.48.0/rc 24,89.2.49.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.7 ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0/24,89.248.172.0/24] any -24,89.2.49.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.185.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19i.0/24,89.248.172.0/24] any -24,89.2.49.0/24,7![! 24,89.2.49.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.p [1724,117.21.191.0/24,89.248.172.0/24] any -24,89.2.49.0/24,7![!p [163.60.48.0/rc`ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.G/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.185.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.19i.0/24,89.248.172.0/24] any -24,89.2.49.0/24,7![!p [163.60.48.0/rc ip [1!3.60.48.0]244T2172.9180/T4,94.102.49.0/24,7![!p [163.60.48.0]244T224,7!::E24/80]:,::E/74RI6.75.4R4RI6.75.18::,::,any,::,::E24,10::,::E/24]I6.724,117.21.191.0248.172.0/24] any -> $ any (28;)