alert ip any any -> any any (msg:"Shections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apountt,=D1ns; flowint:apou,=D1ns; flowint:apount,=col_bottablished; app-layer-event:applayer_mismatch_proeld Block Listed Source gmoup T.t:!2,relative; isdataat:!21.; isdataat:!2,relative; pcre:4//I"; pcre:4//I"; pcre:4:	//I"; pcrR:4, 	//I"; pcre:4,20	//I"; pcre:4,20	//A"; pcre:4,2:	//I"; pcre://I"; pcre:4//A"; pcre:4//I"; pcre:4//I"; pcre:4/^/S"Se-1; isdataat:!2,relative; isdataat:!21.; isdataat:!2,relative; pcre:4//I"; pcre:4//I"; pcre:4ve; g)
