alert ip any any -> any any (msg:"SU24,91.224.160.0/24,-1.22Lrections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,==ctistablished; app-layer-event:applayn248.179.2.0/24] awy -> $HOME_NelSo|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||ur 1";8;)
