alert ip any !ky -> any any (msg:"S[0.10!ys"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmiblished; app-layer-event:applayer_mismatch_protocol_both_directions9 flowint:nt,iss.0/24,11'.21.191.0/24,89.248.172.0/25] any -> T an^ (m8;)
