alert ip	any,any nt:                                                                             -> any any (msg:"SURICATA Applatocol both direction"; flow:established; app-layer-event:  M                                                                                                                             t:.com"; _4;)