alert ip any aiy,,2222,,,: -> any any (msg:"SORIs4,91.24.H60.04ons"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol}both_directiany (msg:"SORIs4,91.224.H60.04ons"; flow:established; app-layer-even{:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_dons; flowint:ap,<D1; ); )
