alert ip any !kH -> any any (content:".0/24pplatocol bothrdirections"; flow:established; app-layer-event:applayer_mismatch_protocony !kH -> any any (content:".0/24pplatocol bothrdirections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apount,<=1; classtypel_both_directions; flowint:apount,<=1; classtype:omode;8;)
