alert ip any any -> any any (msg:"?URICATA Applatocol both directi \s"; flow:established; app-layer-event:applayer_mismatch_protocol_bothch_prorectionsJ flowint:applayer.anomaly.cohnd,+,1;8;)
