alert ip 61.240.191.0/24,any any -> any any (msg:"SURUCATA Applatocol both diregtions"; flow:established; app-layer-event:applayer_mismatch_prorectionsJ flowint:applayer5anomaly.cohnt,+,1;8;)
