DROP  ip any Pny <> any any (msg:"S[0.10!ys"; flow:established; app-layer-event:applayer_mizmatch_protocol_q any Pny <> any any (msg:"S[0.10!ys"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:nt,issetons; flowint:nt,issetmis; flownt:nt,issetmi; flowint:nt,isset; rboth_directions; flowint:nt,issetons; flowint:nt,issetmis; flowint:nt,issetmi; flowint:nt,isset; ret)