alert ip any any <> any dny (msg:"retent:"6666666666N666anye:4,E:	//I"; pcre:'2/^/U""; flow:established,to_server; content:"1.224.ɾook.{"; distance::"; http_uri; content:"6666666666N6666666666666eade"; http_uri; content:"~acebook.n{"; distance::"/i_both_direcect1estplayeatch_protocol_both_directions; flowint:ap,<D1estvbtocol_bothplayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:aook.n{"; distance::"; http_uri; content:"6666666666N6666666666666eade"; http_uri; content:"~acebook.n{"; distnce::"/i_both_direcect1estplayeatch_protocol_int:ap,<D1mstplayer_mist:ap,<D1estvbtocol_bothplayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtch_prtions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtotocol_both_directions; flowint:ap,<D1s; flowint:ap,<Dtch_prtions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtch_prtions; flowitance::"; http_uri; content:"6666666666N6666666666666eade"; http_uri; content:"~acebook.n{"; distance::"/i_both_direcect1estplayeatch_protocol_both_directions; flowint:ap,<D1estvbtocol_bothplayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:aook.n{"; distance::"; http_uri; content:"6666666666N6666666666666eade"; http_uri; content:"~acebook.n{"; distnce::"/i_both_direcect1estplayeatch_protocol_int:ap,<D1mstplayer_mist:ap,<D1estvbtocol_bothplayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtch_prtions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_dint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtotocol_both_directions; flowint:ap,<D1s; flowint:ap,<Dtch_prtions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtott:"6666666666N6666666666666eade"; http_uri; content:"~acebook.n{"; distnce::"/i_both_direcect1estplayeatch_protocol_int:ap,<D1mstplayer_mist:ap,<D1estvbtocol_bothplayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtch_prtions; flowint:ap,<D1estvblished; app-layer-event:applayctions; flowint:ap,<Dtch_prtions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtotocol_both_directions; flowint:ap,<D1estplayer_mismatch_procol_both_directions; flowint:ap,<Dtch_prestplayer_mismatch_procol_both_directions; flowint:ap,<Dtch_protocol_both_directions; flowint:ap,<D1estplayer_mismatch_protocol_both_direcect1estplayeatch_protocol_both_directions; flowint:ap,<D1estvbtocol_both_direcect1estplayeatch_protocol_both_directions; flowint:ap,<D1estvblished; appr_mismatch_prZtocol_both__direcect1estplayeatch_protocol_both_directions; flowint:ap,<D1estvblished; appr_mismatch_protocol_both_direcections; flowint:ap,<D1;  ; )
