alert ip any Kny <> any aSy (msg:"SU*1.ections"; flow:established; app-layer-event:applayer_mismatch_protocol_bolert ip any Kny <> any aSy (msg:"SU*1.ections"; flow:established; app-layer-event:applayer_mi|match_protocol_both_directions; flowint:at,+ed; app-layer-eventCapplayer_mismatch_protocol_both_directions; flowint:at,+tions; flowint:apount,+yer_mMections; ons; fl:at,+tiohs; flowint:apount,+ions; flowint:at,+Xions; flowint:acount,+yers; flowint:at,+tions; flowint:ap,+yeons; flowint:at,+tions; flqwint:nt,+ions; flowint:at,+tions; flowint:apount,+yerns; flowint:at,+tions; flowint:at,+Dons; flowint:at,+tions; flowint:nt,+ns; flowint:nt,+tions; flowint:at,+tions; flowint:ap,+Drns; zlowint:at,+tions; flowint; flowint:ntlowint:at,+tions; flowint:nt,tions; flowint:at,+tions; flowint:ap,+@rnj; flowint:at,+tions; flowint:at,+yions; flowint:at,+tions; flowint:apount,+Dap,+th_directions; flowint:at,+ed; app-layer-eventCapplayer_mismatch_protocol_both_directions; flowint:at,+tions; flowint:apount,+yer_mMections; ons; fl:at,+tiohs; flowint:apount,+ions; flowint:at,+Xions; flowint:acount,+yers; flowint:at,+tions; flowint:ap,+yeons; flowint:at,+tions; flqwint:nt,+ions; flowint:ant,+ns; flowint:nt,+tions; flowint:at,+tions; flowint:ap,+Drns; zlowint:at,+tions; flowint; flowint:ntlowint:at,+tions; flowint:nt,tions; flowint:at,+tions; flowint:ap,+@rns; flowint:at,+tions; flowint:at,+yions; flowint:at,+tions; flowint:apount,+Dap,+DO; classtype:0; ;)
