alert ip any Pny <> any any ( flowbits:set,E"S[R.0!ver; content:"3ns"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1hed; app-layer-event:applayer_mismatch_protocol_both_direany Pny <> any any ( flowbits:set,E"S[R.0!ver; content:"3ns"; flow:established; app-layer-event:applayer_mismatch_protocol_both_dictions; flowint:ap,<D1eed; app-layer-event:applayer_mismatch_protocol_both_directions; flod; a )
