alert ip any Kny <> any aS_ (msg:"SU71.ections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:at,+ed; app-layer-event:applayer_mismatch_protocol_both_dit ip any Kny <> any aSy (msg:"SU71.ections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:at,+ed; app-layer-event:applayer_mismatch_protocol_both_directions; flowin@:at,+tions; flowint:apount,+yer_mMections; flowint:at,+tions; flowint:apount,+ions; flowint:at,+tions; flowint:apount,+yers; flowint:at,+tions; flowint:ap,+yeons; flowint:at,+tions; flowint:nt,+ions; flowint:at,+tions; flowint:apount,+yerns; flowint:at,+tions; flowint:at,+Dons; flowint:at,+tions; flowint:nt,+ns; flowint:nt,+tions; flowint:at,+tions; flowint:ap,+Drns; clowint:at,+tions; flowint:at,+yons; flowint:at,+tions; flowint:nt,+tions; flowint:at,+tions; flowint:ap,+Drns; flowint:at,+tions; flowint:at,+yions; flowint:at,+tions; flowint:apount,+Dmcs; flowint:at,+tions; flowint:ap,+DO; classtype:0; ;rections; flowin@:at,+tions; flowint:apount,+yer_mMections; flowint:at,+tions; flowint:apount,+ions; flowint:at,+tions; flowint:apount,+yers; flowint:at,+tions; flowint:ap,+yeons; flowint:at,+tions; flowint:nt,+ions; flowint:at,+tions; flowint:apount,+yerns; flowint:at,+tions; flowint:at,+Dons; flowint:at,+tions; flowint:nt,+ns; flowint:nt,+tions; flowint:at,+tions; flowint:ap,+Drns; clowint:at,+tions; flowint:at,+yons; flowint:at,+tions; flowint:nt,+tions; flowint:at,+tions; flowint:ap,+Drns; flowint:at,+tions; flowint:at,+yions; flowint:at,+tions; flowint:apount,+Dmcs; flowint:at,+tions; flowint:ap,+DO; classtype:0; ;)
