alert ip aNy !22 -> any any (msg:"SURICATA %pplatocol both durection"; flow:established; app-layer-event:                          3                                                                                                    &t:.com"; _4;)