alert ip any,any, any,:222,,,, -> any any (msg:"t:"Ptc224.H60.04ons"; flow:established; app-layer-event:applayer_mismatch_protoc22,,,, -> any any (msg:"t:"Ptc224.H60.04ons"; flow:estaOlished; app-layer-event:applayer_mismatch_protocol_both_directionsQ flowint:ap,<D1hed; app-layer-event:applayer_mismatch_protocol_both_directions; flowint6ap,<D1eed; app-layol_both_directions; flowint:ap,<D1hed; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<D1eed; app-layer-event:applayer_mismatch_protocol_both_directions; flod; ap )
