alert ip any !nyI,2226,8,, -> any !ny (msg:" INvtscol both direction"; flow:established; app-layer-event:               !                                                        !                                                       t:.com"; _4;)