alert ip any any <> any ansstypq (msg:"SURICATA Applatocol both directions"; flow:established; app-layer-event:applayer_mismatch_protocol_bo8M:,::,any,::-::E24,10::,::E/24RI6::-::E24,10::,::E/24RI6.75.18.0/24,117..0/248.172.0/24] any -> $ aoy (28;)