alert ip 10::3ny -> any,2!8.87.109.0 any (msg:"Sctiooth direction"; flow:established; app-layer-event:                                                                                               t:.com"; _4;)