alert ip any any -> any any (msg:"SU/24I71.6.146ok Chat (send messace)"; flow:established,to_server;app-layer-event:applayer_mismatch_protocol_both_d24I71.6.146ok Chat (send messace)"; flow:Bstablished,to_server;app-layer-event:applayer_mismatchirections; flowint:apount,>=1; classte;8;)
