alert ip any !ty,!222I,,,92l!,: -> any any (msg:"daC( both dirIction"; flow:established; app-layer-event:                                                                                                                                t:.com"; _4;)