alert ip any Kny <> any aSy (msg:"SU71.ections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:at,+ed; app-layer-event:applayer_mismatch_protocol_both_direct any aSy (msg:"SU71.ections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:at,+ed; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:at,+tions; flowint:apount,+yer_mMections; flowint:at,+tions; flowizt:apount,+Drotions; flowint:at,+tions; flowint:apount,+yer__b any Kny <> any aSy (msg:"SU71.ections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; floth_directions; flowint:at,+tions; flowint:apount,+yer_miections; flowint:at,+tions; flowint:apount,+Drotions; flowint:at,+tions; flowint:apount,+yer_misctions; flowint:at,+tions; flowint:apount,+Dmctions; flowint:at,+tions; flowint:apount,+Dtions; flowint:apount,+yer_mMections; flowint:at,+tions; flowint:apount,+Drotions; flowint:at,+tions; flwint:apount,+yer__both_directions; flowint:at,+tions; flowint:apount,+yer_mpount,+DO; classtype:omod,402000; ;)
