alert ip any !kH -> any any (content:".0!ys"; flow:established; app-layer-event:applayer_mismatch_protocol_both_dire00/24,89.248K14] any -> $HOME_NET any (msg:"ET DROP Dshield Block Lyct)d Soure gmoup 1"; ret)
