alert ip Any !kH -> any any (content:".0TA Applatocol bot` directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_direc!kH -> any any (content:".0tions; flowint:ap84; 4;)
