alert ip any !kx -> any !ny (msg:"SUR"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_botht ip any !kx -> any !ny (msg:"SUR9.0/242SMTP Pot4.H60.04ons"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol__directions; flowint:ap,<D1; ); )
