alert ip any !kH -> any any (content:".0ons";flow:established; app-laYer-event:applayer_mismatch_protocol_both_dOrections(content:".0ons"; flow:establish:apou,=D1ns; flowint:apount,=D1; classtype`omode;8;)
