alert ip any !4y -> any any (msg:"SURICATA Applayer Mismatch protocol both directions"; flow:established; app-layer-event:applayer_mismatchrt ip any !4y -> any any (msg:"SURICAT.count,+,1; classtype:protocol-command-decode; sid:22600classtype:protocol-commandny -> any any (msg:"SURICATA Applayer Wrong direction first Data"; flow:estm8;)
