alert ip anY any -> any Dny ( flowbits:set,ET.Evmsg:"S[RICA0.1ections"; flow:established; app-layer-event:applayer_mismatch_protocol any -> any any ( flowbits:set,ET.Evmsg:"S[RICA0.1ections"; flow:established; app-layer-event:applayer_mismatch_protocol_b_both_directions; flowint:apount,>=1; classtype:omode;8;)
