alert ip any any -> any any ( flowbits:set,ET.Evmsg:"S[RICA0.10!35.62.0/24,71.6.146.0/ed; app-layer-event:a]player_mismatch_protoco ip any any -> any any ( flowbits:set,ET.Evmsg:"S[RICA0.10!35.62.0/24,71.6.146.0/ed; app-layer-event:a]player_mismatch_protocoh_both_directions; flowint:apnV,+;)h_both_directions; flowint:apnV,+;)
