alert ip any !kH <> any any (content:".0entApplayer Misnly one di^ection"; flow:established; app-layer-event:applayer_detect_protocol_only_one_dt ip any !kH <> any any (content:".0entApplayer Misnly one di^ection"; flow:established; app-laymaly.count,+,1; classtype:protocZl-command-decode; sid:2260003; rev:1;)

