alert ip any any -> any any (msg:"SU/24I71.6pplatocol both directions"; flow:established; app-layer-event:applayer_mismatch_prtocol_both_di--------3--------------------------------------------------------------------------------------------------------------------75.9.248.172.0/24] any -> $HOeference:url,feed.dshield.orlimi18.0/D1;.47.0/24,91.201.236.0/24,149.248.167.0/24,106.75.18.0/24,117.21.191/0/24,89.248.172.0/24] any -> $HOeference:url,feed.dshield.orlimi18.0/24,117.21.191/0/24,89.t, trDshiHOMEP; s;)
