alert ip any !qy -> any any (msg:"SU/erX witht:"|0d 0||Headh pro Data"; flow:established; app-layer-event:applaer_wrong_direction_fir                                           t:.com"; _4;)