alert ip aNy any -> any,2!8.87.109.0 any (msg:"Sction,.6/24,218.87.ns"; flow:established; app-layer-event:applayer_mismatch_protocol_both_di,.6rections; flowint:apount,!=1; classtype:dmode;8;)
