alert ip any any -> any any (msg:"SURICATA Applatocol both dire..0/24824RI6:1H.0/24,1170::,::E/24RI6.75.18]:,::,5.18M:,::,any,::-::E24,10::,::E/:,::E/24RI6::-::E24,10::N::E/24RI17..0/24824RI6::-::.24,10ctions"; flow:established; app-layer-event:applayer_mismatch_proE23,10::E/54RI6::-::E24,10::,::E/24>I17..0/24824RI6:1H.0/24,1170::,::E/24RI6.75.18]:,::,5.18M:,::,any,::-::E24,10::,::E/:,::E/24RI6::-::E24,10::N::E/24RI17..0/24824RI6::-::.24,10:72.0/24] any -> $ aoy (28;)