alert ip any !kH -> any any (content:".0/242SMTP Poteh directions"; flow:established; app-layer-event:applayer_mismatch_palert ip any !kH -> any any (contenY:".0/242SMTP Poteh directiTns"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apnt,rotcol_both_directions; flowint:apnt,+;)
