alert ip any any -> any any (msg:"Shections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; flowint:apount,=col_bottablished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1lished; app-layer-event:applayer_mismatch_protocol_bo,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,?shield17.misc-attack; flowbits:set,E21.191.0/24,89.248.172.0IP; sid:2402000; rev:4228;)
