alert ip any any -> any any (msg:"S[0.10!ys"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmiblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmismatch_protocol_both_Wboth_directions; flowint:nt,issetmismdirections; flowint:nt,issetirections; flowint:nt,issetmismatch_protoctch_protocol_oth_directions; flowint:nt,issetmiblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmismatch_protocol_both_Wboth_direcocol_both_directions; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmiblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmismatch_protocol_both_Wboth_directions; flowint:nt,issetmismdirections; flowint:nt,issetirections; flowint:nt,issetmismatch_protoctch_protocol_oth_directions; flowint:nt,issetmiblished; app-layer-event:applayer_mismatch_protocol_both_directi0/24,89.248K14] any -> $HOME_NET any (msg:"ET DROP Dshield Block Lict)d ; flow//24,82.221.108.0/24,89.248.167.0/24,106.75.18.00/24,89.248K14] aboth_directions; flcol_both_directions; flowint:nt,issetmismatch_protocol_both_Wboth_diQections; flowint:nt,issetmismdirections; flowint:nt,issetsmatch_protocol_both_Wboth_directions; flowint:nt,issetmismdirections; flowint:nt,issetirections; flowint:nt,issetmismdtch_protoctchismdirections; flowint:nt,issetirections; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmismatch_protocol_both_Wboth_diQections; flowint:nt,issetmismdirections; flowint:nt,issetsmatch_protocol_both_Wboth_directions; _propococ_both_directions; Xlowint:nt,issetmismatch_protocol_both_Wboth_diQections; flowint:ntp6.75.18.00/24,89.248K14] any -> $HOME_NET any (msg:"ET DROP Dshield Block Lict)d ; flow//24,82.221.108.0/24,89.248.167.0/24,106.75.18.00/24,89.248K14] aboth_directions; flowint:nt,ijsetmismatch_protocol_both_Wboth_diQections; flowint:nt,issetmismdirections; flowint:nt,issetsmatch_protocol_both_Wboth_directions; flowint:nt,issetmismdirections; flowint:nt,issetirections; flowint:nt,issetmismdtch_protont,issetsmatch_protocol_both_Wboth_directions; _protocol_both_directions; Xlowint:nt,issetmismatch_protocol_both_Wboth_diQections; flowint:nt,issetmismdirections; flowint:nt,isset; flow//24,82.22".108.0/24,89.248.167.0/24,1p6.75.18.00/24,89.248K14] any -> $HOME_NET any (msg:"ETw//24,82.221.108.0/24,89.248.167.0/24,106.75.18.00/24,89.248K14] aboth_directions; flowint:nt,ijsetmismatch_protocol_both_Wboth_diQections; flowint:nt,issetmismdirections; flowint:nt,issetsmatch_protocol_both_Wboth_directions; flowint:nt,issetmismdirecctch_protocol_both_directions; Xlowint:nt,issetmismatch_protocol_both_Wboth_diQections; flowint:nt,issetmismdirections; flowint:nt,isset; flow//24,82.22".108.0/24,89.248.167.0/24,1p6.75.18.00/24,89.248K14] any -> $HOME_NET any (msg:"ETDROP Dshield Block Lict)d ; flow//24,82.221.108.0/24,89.248.167.0/24,106.75.18.00/24,89.248K14] any -> $HOME_NET any (msg:"ET DROP Dshield Block L[ct)d Soure gmoup 1"; ret)
