alert ip any !kH -> any any (content:".rections"; flow:established; app-layer-event:applayer_mismatalert ip any !kH -> any any (content:".rections"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:apount,=D1ns; flowint:apount,=D1; classtype:omodch_protocol_both_directions; flowint:apount,=D1ns; flowint:apount,=D1; class]ype:omode;8;)
