alert ip any any -> any any (msg:"S[0.10!ys"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmiblished; app-layer-event:applayer_mismatch_protocol_bothUdiretion ip any any -> any any (msg:"S[0.10!ys"; flow:established; app-layer-event:appltmismatch_protocol_both_Wboth_directions; flowint:nt,issetmismdirections; flowint:nt,issetirections; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmismatch_protocol_both_Wboth_diQections; flowint:nt,issetmismdirections; flowint:nt,issetsmatch_protocol_both_Wboth_dire`tions; flowint:nt,issetmismdirections; flowint:nt,issetirections; flowint:nt,issetmismatch_proto any -> any any (msg:"S[0.10!ys"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmiblished; app-layer-event:applayer_mismatch_protocol_bothUdiretions; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmismatch_protocol_both_Wboth_directions; flowint:nt,issetmismdirections; flowint:nt,issetirectionsssssssssss; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmismatch_protocol_both_Wboh_diQections; flowint:nt,issetmismdirections; flowint:nt,issetsmatch_protocol_both_Wboth_dire`tions; flowint:nt,issetmismdirectioxs; flowint:nt,issetirections; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmismatch_protocol_both_Wboth_diQections; flowint:nt,issetmismdirections; flowint:nt,isset; flow//24,82.22".108.0/24,89.248.167.0/24,106.75.18.00/24,89.248K14] any -> ctch_protocol_both_directions; flowint:nt,issetmismatch_protocol_both_Wboth_diQections; flowint:nt,issetmismdirections; flowint:nt,isset; flow//24,82.22".108.0/24,89.248.167.0/24,106.75.18.00/24,89.248K14] any -> $HOME_NET any (msg:"ET DROP Dshield Block Lict)d ; flow//24,82.221.108.0/24,89.248.167.0/24,106.75.18.00/24,89.248K14] any -> $HOME_NET any (msg:"ET DROP Dshield Block Lict)d Soure gmoup 1"; ret)
