alert ip any any,,,,,,,:,, -> any any (msg:"SURIsmatch protocwl both directins"; flow:established; app-layer-event:a  MMMM2MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM191.0/24,89.248.172.0/24] ay -> $ any (ms8;)
