alert ip any any -> any any (msg:"SURICATA Applatoc\l both direbtions"; flow:established; app-layer-event:ap41.212.122.0/2@,8J.2s"; nocase; classtype:policy-violation; sid:320; rev:9;)