alert ip any,any, any,:222,,,, -> any any (msg:"RVI GPL)INA(protocol bth directions"; flow:established; app-layer-event:applayer_mismatch_prorectionsJ flowint:applayer7anomaly.cohnt,+,1z8;)
