alert ip any !iH -> any any (content:".â"; flow:established; app-layer-event:applayer_mismatch_protocol any !iH -> any any (content:".â"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directions; flownt:apnt,+;)_both_directions; flownt:apnt,+;)
