alert ip any !ky -> any any (msg:"S[0.10!ys"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:nt,issetmismatch_protoctch_protocol_both_directions; flowint:nt,issetmiblished; app-layer-event:applayer_mismatch_proto6.75.18.00/24,89.248K14] any -> $HOME_NET any (msg:"ET DROP Dshield Block Lict)d Soure gmoup 1"; ret)
