alert ip any !iH -> any any (content:".0etions";app-layer-event:applayerdmismatch_protocol_both_directy any (content:".0etions";app-layer-event:applayerdmismatch_protocol_both_directions; flowint:at,+tigns; flowint:Mpount,+DO;flowint:apount,+DO; classtye:omode;8;ions; flowint:at,+tigns; flowint:Mpount,+DO;flowint:apount,+DO; classtye:omode;8;)
