alert ip any,82.221.105.0/ any <> any any (msg:"SURICA"ma\ch protocol both directions"; flow:established; app-layer-event:applaer_mismapp-layer-event:applaer_mismatch_prorectiontch_prorectionsJ flowint:aplayer.anoma?czhnt,+,T;8;)
