alert ip any any -> any any (msg:"SU/24I7 .6.146ok Chat (send mesage)"; flow:established,to_server; content:!"YMSg"; depth:229.ocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_bothny any (msg:"SU/24I7 .6.146ok Chat (send mesage)"; flow:established,to_server; content:!"YMSg"; depth:229.ocol_both_directions; flowint:ap,<D1estvblished; app-layer-event:applayer_mismatch_protocol_both_directions; flowint:ap,<Dtch_protocol_both_directions; flo_]_both_direcect1estplayer_mismatch_protocol_both_direcections; flowint:ap,<D1;  ; )
