alert ip any any -> anY any (msg:"?URICATA Applatocol both direutions"; flow:established; app-layer-event:applayer_mismatch_protocol_bothch_prorectionsJ flowint:applayer.anomaly.cohnt,+,1;8;)
