alert tcp any any -> any any (msg:"3com-tsmux"; appid:3com-tsmux; sid:1000000; rev:1)
alert tcp any any -> any any (msg:"914cg"; appid:914cg; sid:1000001; rev:1)
alert tcp any any -> any any (msg:"aca_services"; appid:aca_services; sid:1000002; rev:1)
alert tcp any any -> any any (msg:"aci"; appid:aci; sid:1000003; rev:1)
alert tcp any any -> any any (msg:"acr-nema"; appid:acr-nema; sid:1000004; rev:1)
alert tcp any any -> any any (msg:"activesync"; appid:activesync; sid:1000005; rev:1)
alert tcp any any -> any any (msg:"adrive"; appid:adrive; sid:1000006; rev:1)
alert tcp any any -> any any (msg:"aed512"; appid:aed512; sid:1000007; rev:1)
alert tcp any any -> any any (msg:"afp"; appid:afp; sid:1000008; rev:1)
alert tcp any any -> any any (msg:"ajp"; appid:ajp; sid:1000009; rev:1)
alert tcp any any -> any any (msg:"alias"; appid:alias; sid:1000010; rev:1)
alert tcp any any -> any any (msg:"amazon"; appid:amazon; sid:1000011; rev:1)
alert tcp any any -> any any (msg:"ansa_notify"; appid:ansa_notify; sid:1000012; rev:1)
alert tcp any any -> any any (msg:"ansa_rex_trader"; appid:ansa_rex_trader; sid:1000013; rev:1)
alert tcp any any -> any any (msg:"applejuice"; appid:applejuice; sid:1000014; rev:1)
alert tcp any any -> any any (msg:"appleshare"; appid:appleshare; sid:1000015; rev:1)
alert tcp any any -> any any (msg:"apple_update"; appid:apple_update; sid:1000016; rev:1)
alert tcp any any -> any any (msg:"arcisdms"; appid:arcisdms; sid:1000017; rev:1)
alert tcp any any -> any any (msg:"ariel"; appid:ariel; sid:1000018; rev:1)
alert tcp any any -> any any (msg:"arns"; appid:arns; sid:1000019; rev:1)
alert tcp any any -> any any (msg:"asa"; appid:asa; sid:1000020; rev:1)
alert tcp any any -> any any (msg:"astraweb"; appid:astraweb; sid:1000021; rev:1)
alert tcp any any -> any any (msg:"auditd"; appid:auditd; sid:1000022; rev:1)
alert tcp any any -> any any (msg:"audit"; appid:audit; sid:1000023; rev:1)
alert tcp any any -> any any (msg:"avg"; appid:avg; sid:1000024; rev:1)
alert tcp any any -> any any (msg:"avira_download"; appid:avira_download; sid:1000025; rev:1)
alert tcp any any -> any any (msg:"avocent"; appid:avocent; sid:1000026; rev:1)
alert tcp any any -> any any (msg:"backblaze"; appid:backblaze; sid:1000027; rev:1)
alert tcp any any -> any any (msg:"backpack"; appid:backpack; sid:1000028; rev:1)
alert tcp any any -> any any (msg:"battlefield"; appid:battlefield; sid:1000029; rev:1)
alert tcp any any -> any any (msg:"bftp"; appid:bftp; sid:1000030; rev:1)
alert tcp any any -> any any (msg:"bgmp"; appid:bgmp; sid:1000031; rev:1)
alert tcp any any -> any any (msg:"bh611"; appid:bh611; sid:1000032; rev:1)
alert tcp any any -> any any (msg:"bhevent"; appid:bhevent; sid:1000033; rev:1)
alert tcp any any -> any any (msg:"bhfhs"; appid:bhfhs; sid:1000034; rev:1)
alert tcp any any -> any any (msg:"bhmds"; appid:bhmds; sid:1000035; rev:1)
alert tcp any any -> any any (msg:"bing"; appid:bing; sid:1000036; rev:1)
alert tcp any any -> any any (msg:"bitdefender"; appid:bitdefender; sid:1000037; rev:1)
alert tcp any any -> any any (msg:"bits"; appid:bits; sid:1000038; rev:1)
alert tcp any any -> any any (msg:"bt"; appid:bt; sid:1000039; rev:1)
alert tcp any any -> any any (msg:"blackboard"; appid:blackboard; sid:1000040; rev:1)
alert tcp any any -> any any (msg:"blackjack_protocol"; appid:blackjack_protocol; sid:1000041; rev:1)
alert tcp any any -> any any (msg:"blazefs"; appid:blazefs; sid:1000042; rev:1)
alert tcp any any -> any any (msg:"britton_lee_idm"; appid:britton_lee_idm; sid:1000043; rev:1)
alert tcp any any -> any any (msg:"bnet"; appid:bnet; sid:1000044; rev:1)
alert tcp any any -> any any (msg:"cableport_ax"; appid:cableport_ax; sid:1000045; rev:1)
alert tcp any any -> any any (msg:"caicci"; appid:caicci; sid:1000046; rev:1)
alert tcp any any -> any any (msg:"cap"; appid:cap; sid:1000047; rev:1)
alert tcp any any -> any any (msg:"cdc"; appid:cdc; sid:1000048; rev:1)
alert tcp any any -> any any (msg:"checkpoint"; appid:checkpoint; sid:1000049; rev:1)
alert tcp any any -> any any (msg:"cisco_drp"; appid:cisco_drp; sid:1000050; rev:1)
alert tcp any any -> any any (msg:"cisco_fnative"; appid:cisco_fnative; sid:1000051; rev:1)
alert tcp any any -> any any (msg:"cisco_gdp"; appid:cisco_gdp; sid:1000052; rev:1)
alert tcp any any -> any any (msg:"cisco_sla"; appid:cisco_sla; sid:1000053; rev:1)
alert tcp any any -> any any (msg:"cisco_sysmaint"; appid:cisco_sysmaint; sid:1000054; rev:1)
alert tcp any any -> any any (msg:"cisco_tnative"; appid:cisco_tnative; sid:1000055; rev:1)
alert tcp any any -> any any (msg:"citrix_ima"; appid:citrix_ima; sid:1000056; rev:1)
alert tcp any any -> any any (msg:"citrix_licensing"; appid:citrix_licensing; sid:1000057; rev:1)
alert tcp any any -> any any (msg:"citrix_online"; appid:citrix_online; sid:1000058; rev:1)
alert tcp any any -> any any (msg:"citrix_rtmp"; appid:citrix_rtmp; sid:1000059; rev:1)
alert tcp any any -> any any (msg:"citrix_slg"; appid:citrix_slg; sid:1000060; rev:1)
alert tcp any any -> any any (msg:"citrix_wanscaler"; appid:citrix_wanscaler; sid:1000061; rev:1)
alert tcp any any -> any any (msg:"cl1"; appid:cl1; sid:1000062; rev:1)
alert tcp any any -> any any (msg:"clearcase"; appid:clearcase; sid:1000063; rev:1)
alert tcp any any -> any any (msg:"cloanto"; appid:cloanto; sid:1000064; rev:1)
alert tcp any any -> any any (msg:"cmip"; appid:cmip; sid:1000065; rev:1)
alert tcp any any -> any any (msg:"coda_auth"; appid:coda_auth; sid:1000066; rev:1)
alert tcp any any -> any any (msg:"commvault"; appid:commvault; sid:1000067; rev:1)
alert tcp any any -> any any (msg:"compressnet"; appid:compressnet; sid:1000068; rev:1)
alert tcp any any -> any any (msg:"comscm"; appid:comscm; sid:1000069; rev:1)
alert tcp any any -> any any (msg:"corba"; appid:corba; sid:1000070; rev:1)
alert tcp any any -> any any (msg:"dasp"; appid:dasp; sid:1000071; rev:1)
alert tcp any any -> any any (msg:"datex-asn"; appid:datex-asn; sid:1000072; rev:1)
alert tcp any any -> any any (msg:"dbase"; appid:dbase; sid:1000073; rev:1)
alert tcp any any -> any any (msg:"dcap"; appid:dcap; sid:1000074; rev:1)
alert tcp any any -> any any (msg:"dccp"; appid:dccp; sid:1000075; rev:1)
alert tcp any any -> any any (msg:"dcp"; appid:dcp; sid:1000076; rev:1)
alert tcp any any -> any any (msg:"dec_auth"; appid:dec_auth; sid:1000077; rev:1)
alert tcp any any -> any any (msg:"dec_ladebug"; appid:dec_ladebug; sid:1000078; rev:1)
alert tcp any any -> any any (msg:"decvms"; appid:decvms; sid:1000079; rev:1)
alert tcp any any -> any any (msg:"deos"; appid:deos; sid:1000080; rev:1)
alert tcp any any -> any any (msg:"dhcpv6-server"; appid:dhcpv6-server; sid:1000081; rev:1)
alert tcp any any -> any any (msg:"digg"; appid:digg; sid:1000082; rev:1)
alert tcp any any -> any any (msg:"direct_connect"; appid:direct_connect; sid:1000083; rev:1)
alert tcp any any -> any any (msg:"pdre"; appid:pdre; sid:1000084; rev:1)
alert tcp any any -> any any (msg:"dixie"; appid:dixie; sid:1000085; rev:1)
alert tcp any any -> any any (msg:"dls"; appid:dls; sid:1000086; rev:1)
alert tcp any any -> any any (msg:"dna-cml"; appid:dna-cml; sid:1000087; rev:1)
alert tcp any any -> any any (msg:"dnsix"; appid:dnsix; sid:1000088; rev:1)
alert tcp any any -> any any (msg:"dpsi"; appid:dpsi; sid:1000089; rev:1)
alert tcp any any -> any any (msg:"dropbox"; appid:dropbox; sid:1000090; rev:1)
alert tcp any any -> any any (msg:"dsfgw"; appid:dsfgw; sid:1000091; rev:1)
alert tcp any any -> any any (msg:"dsp3270"; appid:dsp3270; sid:1000092; rev:1)
alert tcp any any -> any any (msg:"dsp"; appid:dsp; sid:1000093; rev:1)
alert tcp any any -> any any (msg:"dtag"; appid:dtag; sid:1000094; rev:1)
alert tcp any any -> any any (msg:"dtk"; appid:dtk; sid:1000095; rev:1)
alert tcp any any -> any any (msg:"ebay"; appid:ebay; sid:1000096; rev:1)
alert tcp any any -> any any (msg:"ebay_bid"; appid:ebay_bid; sid:1000097; rev:1)
alert tcp any any -> any any (msg:"ebay_search"; appid:ebay_search; sid:1000098; rev:1)
alert tcp any any -> any any (msg:"ebay_watch"; appid:ebay_watch; sid:1000099; rev:1)
alert tcp any any -> any any (msg:"ebuddy"; appid:ebuddy; sid:1000100; rev:1)
alert tcp any any -> any any (msg:"emblndt"; appid:emblndt; sid:1000101; rev:1)
alert tcp any any -> any any (msg:"emfis_data"; appid:emfis_data; sid:1000102; rev:1)
alert tcp any any -> any any (msg:"entrusttime"; appid:entrusttime; sid:1000103; rev:1)
alert tcp any any -> any any (msg:"erpc"; appid:erpc; sid:1000104; rev:1)
alert tcp any any -> any any (msg:"eset"; appid:eset; sid:1000105; rev:1)
alert tcp any any -> any any (msg:"esro"; appid:esro; sid:1000106; rev:1)
alert tcp any any -> any any (msg:"etos"; appid:etos; sid:1000107; rev:1)
alert tcp any any -> any any (msg:"facebook_apps"; appid:facebook_apps; sid:1000108; rev:1)
alert tcp any any -> any any (msg:"fark"; appid:fark; sid:1000109; rev:1)
alert tcp any any -> any any (msg:"fasttrack"; appid:fasttrack; sid:1000110; rev:1)
alert tcp any any -> any any (msg:"fatmen"; appid:fatmen; sid:1000111; rev:1)
alert tcp any any -> any any (msg:"filemaker"; appid:filemaker; sid:1000112; rev:1)
alert tcp any any -> any any (msg:"flashget"; appid:flashget; sid:1000113; rev:1)
alert tcp any any -> any any (msg:"flickr"; appid:flickr; sid:1000114; rev:1)
alert tcp any any -> any any (msg:"flixster"; appid:flixster; sid:1000115; rev:1)
alert tcp any any -> any any (msg:"fogbugz"; appid:fogbugz; sid:1000116; rev:1)
alert tcp any any -> any any (msg:"f-prot"; appid:f-prot; sid:1000117; rev:1)
alert tcp any any -> any any (msg:"freecast"; appid:freecast; sid:1000118; rev:1)
alert tcp any any -> any any (msg:"friendfeed"; appid:friendfeed; sid:1000119; rev:1)
alert tcp any any -> any any (msg:"ftp"; appid:ftp; sid:1000120; rev:1)
alert tcp any any -> any any (msg:"ftp-data"; appid:ftp-data; sid:1000121; rev:1)
alert tcp any any -> any any (msg:"ftpsdata"; appid:ftpsdata; sid:1000122; rev:1)
alert tcp any any -> any any (msg:"ftps"; appid:ftps; sid:1000123; rev:1)
alert tcp any any -> any any (msg:"fxp"; appid:fxp; sid:1000124; rev:1)
alert tcp any any -> any any (msg:"gacp"; appid:gacp; sid:1000125; rev:1)
alert tcp any any -> any any (msg:"ganglia"; appid:ganglia; sid:1000126; rev:1)
alert tcp any any -> any any (msg:"genie"; appid:genie; sid:1000127; rev:1)
alert tcp any any -> any any (msg:"genrad"; appid:genrad; sid:1000128; rev:1)
alert tcp any any -> any any (msg:"giganews"; appid:giganews; sid:1000129; rev:1)
alert tcp any any -> any any (msg:"giop"; appid:giop; sid:1000130; rev:1)
alert tcp any any -> any any (msg:"gist"; appid:gist; sid:1000131; rev:1)
alert tcp any any -> any any (msg:"google_apis"; appid:google_apis; sid:1000132; rev:1)
alert tcp any any -> any any (msg:"google_app_engine"; appid:google_app_engine; sid:1000133; rev:1)
alert tcp any any -> any any (msg:"google_drive"; appid:google_drive; sid:1000134; rev:1)
alert tcp any any -> any any (msg:"google_talk_gadget"; appid:google_talk_gadget; sid:1000135; rev:1)
alert tcp any any -> any any (msg:"google"; appid:google; sid:1000136; rev:1)
alert tcp any any -> any any (msg:"google_translate"; appid:google_translate; sid:1000137; rev:1)
alert tcp any any -> any any (msg:"gotomeeting"; appid:gotomeeting; sid:1000138; rev:1)
alert tcp any any -> any any (msg:"gpfs"; appid:gpfs; sid:1000139; rev:1)
alert tcp any any -> any any (msg:"groupwise"; appid:groupwise; sid:1000140; rev:1)
alert tcp any any -> any any (msg:"gss_x_license_verification"; appid:gss_x_license_verification; sid:1000141; rev:1)
alert tcp any any -> any any (msg:"itu-h225"; appid:itu-h225; sid:1000142; rev:1)
alert tcp any any -> any any (msg:"itu-h245"; appid:itu-h245; sid:1000143; rev:1)
alert tcp any any -> any any (msg:"hassle"; appid:hassle; sid:1000144; rev:1)
alert tcp any any -> any any (msg:"hdap"; appid:hdap; sid:1000145; rev:1)
alert tcp any any -> any any (msg:"hems"; appid:hems; sid:1000146; rev:1)
alert tcp any any -> any any (msg:"hivestor"; appid:hivestor; sid:1000147; rev:1)
alert tcp any any -> any any (msg:"hl7"; appid:hl7; sid:1000148; rev:1)
alert tcp any any -> any any (msg:"winlive_hotmail"; appid:winlive_hotmail; sid:1000149; rev:1)
alert tcp any any -> any any (msg:"hp_perf"; appid:hp_perf; sid:1000150; rev:1)
alert tcp any any -> any any (msg:"hp_vmm"; appid:hp_vmm; sid:1000151; rev:1)
alert tcp any any -> any any (msg:"httpmgt"; appid:httpmgt; sid:1000152; rev:1)
alert tcp any any -> any any (msg:"hyper-g"; appid:hyper-g; sid:1000153; rev:1)
alert tcp any any -> any any (msg:"iasd"; appid:iasd; sid:1000154; rev:1)
alert tcp any any -> any any (msg:"ica_browser"; appid:ica_browser; sid:1000155; rev:1)
alert tcp any any -> any any (msg:"icad"; appid:icad; sid:1000156; rev:1)
alert tcp any any -> any any (msg:"icap"; appid:icap; sid:1000157; rev:1)
alert tcp any any -> any any (msg:"ica"; appid:ica; sid:1000158; rev:1)
alert tcp any any -> any any (msg:"iceshare"; appid:iceshare; sid:1000159; rev:1)
alert tcp any any -> any any (msg:"icp"; appid:icp; sid:1000160; rev:1)
alert tcp any any -> any any (msg:"icq2go"; appid:icq2go; sid:1000161; rev:1)
alert tcp any any -> any any (msg:"isakmp"; appid:isakmp; sid:1000162; rev:1)
alert tcp any any -> any any (msg:"imgames"; appid:imgames; sid:1000163; rev:1)
alert tcp any any -> any any (msg:"imsp"; appid:imsp; sid:1000164; rev:1)
alert tcp any any -> any any (msg:"inbusiness"; appid:inbusiness; sid:1000165; rev:1)
alert tcp any any -> any any (msg:"informix"; appid:informix; sid:1000166; rev:1)
alert tcp any any -> any any (msg:"infoseek"; appid:infoseek; sid:1000167; rev:1)
alert tcp any any -> any any (msg:"ingresnet"; appid:ingresnet; sid:1000168; rev:1)
alert tcp any any -> any any (msg:"ircu"; appid:ircu; sid:1000169; rev:1)
alert tcp any any -> any any (msg:"isi_graphics"; appid:isi_graphics; sid:1000170; rev:1)
alert tcp any any -> any any (msg:"jargon"; appid:jargon; sid:1000171; rev:1)
alert tcp any any -> any any (msg:"kaspersky"; appid:kaspersky; sid:1000172; rev:1)
alert tcp any any -> any any (msg:"k-block"; appid:k-block; sid:1000173; rev:1)
alert tcp any any -> any any (msg:"kftpdata"; appid:kftpdata; sid:1000174; rev:1)
alert tcp any any -> any any (msg:"kftp"; appid:kftp; sid:1000175; rev:1)
alert tcp any any -> any any (msg:"kis"; appid:kis; sid:1000176; rev:1)
alert tcp any any -> any any (msg:"knetcmp"; appid:knetcmp; sid:1000177; rev:1)
alert tcp any any -> any any (msg:"kryptolan"; appid:kryptolan; sid:1000178; rev:1)
alert tcp any any -> any any (msg:"ktelnet"; appid:ktelnet; sid:1000179; rev:1)
alert tcp any any -> any any (msg:"kugou"; appid:kugou; sid:1000180; rev:1)
alert tcp any any -> any any (msg:"kvm"; appid:kvm; sid:1000181; rev:1)
alert tcp any any -> any any (msg:"kwdb"; appid:kwdb; sid:1000182; rev:1)
alert tcp any any -> any any (msg:"l2tp"; appid:l2tp; sid:1000183; rev:1)
alert tcp any any -> any any (msg:"last.fm"; appid:last.fm; sid:1000184; rev:1)
alert tcp any any -> any any (msg:"legent"; appid:legent; sid:1000185; rev:1)
alert tcp any any -> any any (msg:"link"; appid:link; sid:1000186; rev:1)
alert tcp any any -> any any (msg:"live365"; appid:live365; sid:1000187; rev:1)
alert tcp any any -> any any (msg:"llmnr"; appid:llmnr; sid:1000188; rev:1)
alert tcp any any -> any any (msg:"locus_map"; appid:locus_map; sid:1000189; rev:1)
alert tcp any any -> any any (msg:"logmein"; appid:logmein; sid:1000190; rev:1)
alert tcp any any -> any any (msg:"magenta_logic"; appid:magenta_logic; sid:1000191; rev:1)
alert tcp any any -> any any (msg:"mailq"; appid:mailq; sid:1000192; rev:1)
alert tcp any any -> any any (msg:"manet"; appid:manet; sid:1000193; rev:1)
alert tcp any any -> any any (msg:"mapi"; appid:mapi; sid:1000194; rev:1)
alert tcp any any -> any any (msg:"masqudialer"; appid:masqudialer; sid:1000195; rev:1)
alert tcp any any -> any any (msg:"matip"; appid:matip; sid:1000196; rev:1)
alert tcp any any -> any any (msg:"mcafee"; appid:mcafee; sid:1000197; rev:1)
alert tcp any any -> any any (msg:"mc-ftp"; appid:mc-ftp; sid:1000198; rev:1)
alert tcp any any -> any any (msg:"mcidas"; appid:mcidas; sid:1000199; rev:1)
alert tcp any any -> any any (msg:"mck-ivpip"; appid:mck-ivpip; sid:1000200; rev:1)
alert tcp any any -> any any (msg:"mediafire"; appid:mediafire; sid:1000201; rev:1)
alert tcp any any -> any any (msg:"meeting_maker"; appid:meeting_maker; sid:1000202; rev:1)
alert tcp any any -> any any (msg:"metagram"; appid:metagram; sid:1000203; rev:1)
alert tcp any any -> any any (msg:"mf_cobol"; appid:mf_cobol; sid:1000204; rev:1)
alert tcp any any -> any any (msg:"mftp"; appid:mftp; sid:1000205; rev:1)
alert tcp any any -> any any (msg:"mini_sql"; appid:mini_sql; sid:1000206; rev:1)
alert tcp any any -> any any (msg:"mit-ml-dev"; appid:mit-ml-dev; sid:1000207; rev:1)
alert tcp any any -> any any (msg:"mit_spooler"; appid:mit_spooler; sid:1000208; rev:1)
alert tcp any any -> any any (msg:"mixi"; appid:mixi; sid:1000209; rev:1)
alert tcp any any -> any any (msg:"mobileip"; appid:mobileip; sid:1000210; rev:1)
alert tcp any any -> any any (msg:"mortgageware"; appid:mortgageware; sid:1000211; rev:1)
alert tcp any any -> any any (msg:"mpm"; appid:mpm; sid:1000212; rev:1)
alert tcp any any -> any any (msg:"mptn"; appid:mptn; sid:1000213; rev:1)
alert tcp any any -> any any (msg:"ms_crs"; appid:ms_crs; sid:1000214; rev:1)
alert tcp any any -> any any (msg:"msdn"; appid:msdn; sid:1000215; rev:1)
alert tcp any any -> any any (msg:"msg"; appid:msg; sid:1000216; rev:1)
alert tcp any any -> any any (msg:"msmq"; appid:msmq; sid:1000217; rev:1)
alert tcp any any -> any any (msg:"msnp"; appid:msnp; sid:1000218; rev:1)
alert tcp any any -> any any (msg:"msn"; appid:msn; sid:1000219; rev:1)
alert tcp any any -> any any (msg:"ms_olap"; appid:ms_olap; sid:1000220; rev:1)
alert tcp any any -> any any (msg:"msp"; appid:msp; sid:1000221; rev:1)
alert tcp any any -> any any (msg:"myspace"; appid:myspace; sid:1000222; rev:1)
alert tcp any any -> any any (msg:"namp"; appid:namp; sid:1000223; rev:1)
alert tcp any any -> any any (msg:"napster"; appid:napster; sid:1000224; rev:1)
alert tcp any any -> any any (msg:"nced"; appid:nced; sid:1000225; rev:1)
alert tcp any any -> any any (msg:"ncld"; appid:ncld; sid:1000226; rev:1)
alert tcp any any -> any any (msg:"nds_auth"; appid:nds_auth; sid:1000227; rev:1)
alert tcp any any -> any any (msg:"netinfo"; appid:netinfo; sid:1000228; rev:1)
alert tcp any any -> any any (msg:"netsc"; appid:netsc; sid:1000229; rev:1)
alert tcp any any -> any any (msg:"netscout"; appid:netscout; sid:1000230; rev:1)
alert tcp any any -> any any (msg:"netware"; appid:netware; sid:1000231; rev:1)
alert tcp any any -> any any (msg:"nfa"; appid:nfa; sid:1000232; rev:1)
alert tcp any any -> any any (msg:"ni_ftp"; appid:ni_ftp; sid:1000233; rev:1)
alert tcp any any -> any any (msg:"ni_mail"; appid:ni_mail; sid:1000234; rev:1)
alert tcp any any -> any any (msg:"nip"; appid:nip; sid:1000235; rev:1)
alert tcp any any -> any any (msg:"nnsp"; appid:nnsp; sid:1000236; rev:1)
alert tcp any any -> any any (msg:"novabackup"; appid:novabackup; sid:1000237; rev:1)
alert tcp any any -> any any (msg:"npp"; appid:npp; sid:1000238; rev:1)
alert tcp any any -> any any (msg:"nsiiops"; appid:nsiiops; sid:1000239; rev:1)
alert tcp any any -> any any (msg:"nsrmp"; appid:nsrmp; sid:1000240; rev:1)
alert tcp any any -> any any (msg:"nss"; appid:nss; sid:1000241; rev:1)
alert tcp any any -> any any (msg:"nsstp"; appid:nsstp; sid:1000242; rev:1)
alert tcp any any -> any any (msg:"nxedit"; appid:nxedit; sid:1000243; rev:1)
alert tcp any any -> any any (msg:"nextstep"; appid:nextstep; sid:1000244; rev:1)
alert tcp any any -> any any (msg:"ocbinder"; appid:ocbinder; sid:1000245; rev:1)
alert tcp any any -> any any (msg:"ocserver"; appid:ocserver; sid:1000246; rev:1)
alert tcp any any -> any any (msg:"ocs"; appid:ocs; sid:1000247; rev:1)
alert tcp any any -> any any (msg:"odmr"; appid:odmr; sid:1000248; rev:1)
alert tcp any any -> any any (msg:"oftp"; appid:oftp; sid:1000249; rev:1)
alert tcp any any -> any any (msg:"oftps"; appid:oftps; sid:1000250; rev:1)
alert tcp any any -> any any (msg:"onmux"; appid:onmux; sid:1000251; rev:1)
alert tcp any any -> any any (msg:"opalis_robot"; appid:opalis_robot; sid:1000252; rev:1)
alert tcp any any -> any any (msg:"openport"; appid:openport; sid:1000253; rev:1)
alert tcp any any -> any any (msg:"openvpn"; appid:openvpn; sid:1000254; rev:1)
alert tcp any any -> any any (msg:"oracle_sqlnet"; appid:oracle_sqlnet; sid:1000255; rev:1)
alert tcp any any -> any any (msg:"orkut"; appid:orkut; sid:1000256; rev:1)
alert tcp any any -> any any (msg:"osunms"; appid:osunms; sid:1000257; rev:1)
alert tcp any any -> any any (msg:"panda"; appid:panda; sid:1000258; rev:1)
alert tcp any any -> any any (msg:"partypoker"; appid:partypoker; sid:1000259; rev:1)
alert tcp any any -> any any (msg:"pawserv"; appid:pawserv; sid:1000260; rev:1)
alert tcp any any -> any any (msg:"pcmail"; appid:pcmail; sid:1000261; rev:1)
alert tcp any any -> any any (msg:"pdap"; appid:pdap; sid:1000262; rev:1)
alert tcp any any -> any any (msg:"pftp"; appid:pftp; sid:1000263; rev:1)
alert tcp any any -> any any (msg:"pip"; appid:pip; sid:1000264; rev:1)
alert tcp any any -> any any (msg:"pkix_timestamp"; appid:pkix_timestamp; sid:1000265; rev:1)
alert tcp any any -> any any (msg:"pop2"; appid:pop2; sid:1000266; rev:1)
alert tcp any any -> any any (msg:"ppstream"; appid:ppstream; sid:1000267; rev:1)
alert tcp any any -> any any (msg:"lpr"; appid:lpr; sid:1000268; rev:1)
alert tcp any any -> any any (msg:"profile"; appid:profile; sid:1000269; rev:1)
alert tcp any any -> any any (msg:"prospero"; appid:prospero; sid:1000270; rev:1)
alert tcp any any -> any any (msg:"pwdgen"; appid:pwdgen; sid:1000271; rev:1)
alert tcp any any -> any any (msg:"qbik"; appid:qbik; sid:1000272; rev:1)
alert tcp any any -> any any (msg:"qft"; appid:qft; sid:1000273; rev:1)
alert tcp any any -> any any (msg:"qmtp"; appid:qmtp; sid:1000274; rev:1)
alert tcp any any -> any any (msg:"qotd"; appid:qotd; sid:1000275; rev:1)
alert tcp any any -> any any (msg:"qq"; appid:qq; sid:1000276; rev:1)
alert tcp any any -> any any (msg:"quicktime"; appid:quicktime; sid:1000277; rev:1)
alert tcp any any -> any any (msg:"rap"; appid:rap; sid:1000278; rev:1)
alert tcp any any -> any any (msg:"remote_job_service"; appid:remote_job_service; sid:1000279; rev:1)
alert tcp any any -> any any (msg:"remote_telnet"; appid:remote_telnet; sid:1000280; rev:1)
alert tcp any any -> any any (msg:"rescap"; appid:rescap; sid:1000281; rev:1)
alert tcp any any -> any any (msg:"rip"; appid:rip; sid:1000282; rev:1)
alert tcp any any -> any any (msg:"ris"; appid:ris; sid:1000283; rev:1)
alert tcp any any -> any any (msg:"rje"; appid:rje; sid:1000284; rev:1)
alert tcp any any -> any any (msg:"rlogin"; appid:rlogin; sid:1000285; rev:1)
alert tcp any any -> any any (msg:"rlp"; appid:rlp; sid:1000286; rev:1)
alert tcp any any -> any any (msg:"rmt"; appid:rmt; sid:1000287; rev:1)
alert tcp any any -> any any (msg:"rpc2pmap"; appid:rpc2pmap; sid:1000288; rev:1)
alert tcp any any -> any any (msg:"rrp"; appid:rrp; sid:1000289; rev:1)
alert tcp any any -> any any (msg:"rsvd"; appid:rsvd; sid:1000290; rev:1)
alert tcp any any -> any any (msg:"rtsps"; appid:rtsps; sid:1000291; rev:1)
alert tcp any any -> any any (msg:"sap_hostcontrol"; appid:sap_hostcontrol; sid:1000292; rev:1)
alert tcp any any -> any any (msg:"sco_i2_dialog_daemon"; appid:sco_i2_dialog_daemon; sid:1000293; rev:1)
alert tcp any any -> any any (msg:"secondlife"; appid:secondlife; sid:1000294; rev:1)
alert tcp any any -> any any (msg:"secursight"; appid:secursight; sid:1000295; rev:1)
alert tcp any any -> any any (msg:"semantix"; appid:semantix; sid:1000296; rev:1)
alert tcp any any -> any any (msg:"send"; appid:send; sid:1000297; rev:1)
alert tcp any any -> any any (msg:"set"; appid:set; sid:1000298; rev:1)
alert tcp any any -> any any (msg:"sftp"; appid:sftp; sid:1000299; rev:1)
alert tcp any any -> any any (msg:"sgcp"; appid:sgcp; sid:1000300; rev:1)
alert tcp any any -> any any (msg:"sgmp"; appid:sgmp; sid:1000301; rev:1)
alert tcp any any -> any any (msg:"sharepoint"; appid:sharepoint; sid:1000302; rev:1)
alert tcp any any -> any any (msg:"shrinkwrap"; appid:shrinkwrap; sid:1000303; rev:1)
alert tcp any any -> any any (msg:"silverplatter"; appid:silverplatter; sid:1000304; rev:1)
alert tcp any any -> any any (msg:"sip"; appid:sip; sid:1000305; rev:1)
alert tcp any any -> any any (msg:"skype_auth"; appid:skype_auth; sid:1000306; rev:1)
alert tcp any any -> any any (msg:"slingbox"; appid:slingbox; sid:1000307; rev:1)
alert tcp any any -> any any (msg:"smakynet"; appid:smakynet; sid:1000308; rev:1)
alert tcp any any -> any any (msg:"smart_session_description_protocol"; appid:smart_session_description_protocol; sid:1000309; rev:1)
alert tcp any any -> any any (msg:"smpte"; appid:smpte; sid:1000310; rev:1)
alert tcp any any -> any any (msg:"smsp"; appid:smsp; sid:1000311; rev:1)
alert tcp any any -> any any (msg:"smux"; appid:smux; sid:1000312; rev:1)
alert tcp any any -> any any (msg:"sna_gateway"; appid:sna_gateway; sid:1000313; rev:1)
alert tcp any any -> any any (msg:"snet"; appid:snet; sid:1000314; rev:1)
alert tcp any any -> any any (msg:"snpp"; appid:snpp; sid:1000315; rev:1)
alert tcp any any -> any any (msg:"softpc"; appid:softpc; sid:1000316; rev:1)
alert tcp any any -> any any (msg:"soulseek"; appid:soulseek; sid:1000317; rev:1)
alert tcp any any -> any any (msg:"src"; appid:src; sid:1000318; rev:1)
alert tcp any any -> any any (msg:"srmp"; appid:srmp; sid:1000319; rev:1)
alert tcp any any -> any any (msg:"sender_rewriting_scheme"; appid:sender_rewriting_scheme; sid:1000320; rev:1)
alert tcp any any -> any any (msg:"stationlauncher"; appid:stationlauncher; sid:1000321; rev:1)
alert tcp any any -> any any (msg:"stat_service"; appid:stat_service; sid:1000322; rev:1)
alert tcp any any -> any any (msg:"su-mit_telnet"; appid:su-mit_telnet; sid:1000323; rev:1)
alert tcp any any -> any any (msg:"sunrpc"; appid:sunrpc; sid:1000324; rev:1)
alert tcp any any -> any any (msg:"supdup"; appid:supdup; sid:1000325; rev:1)
alert tcp any any -> any any (msg:"supernews"; appid:supernews; sid:1000326; rev:1)
alert tcp any any -> any any (msg:"sybase_sql"; appid:sybase_sql; sid:1000327; rev:1)
alert tcp any any -> any any (msg:"symantec_system"; appid:symantec_system; sid:1000328; rev:1)
alert tcp any any -> any any (msg:"syslog"; appid:syslog; sid:1000329; rev:1)
alert tcp any any -> any any (msg:"systat"; appid:systat; sid:1000330; rev:1)
alert tcp any any -> any any (msg:"tacacs"; appid:tacacs; sid:1000331; rev:1)
alert tcp any any -> any any (msg:"tcpmux"; appid:tcpmux; sid:1000332; rev:1)
alert tcp any any -> any any (msg:"texar"; appid:texar; sid:1000333; rev:1)
alert tcp any any -> any any (msg:"time_protocol"; appid:time_protocol; sid:1000334; rev:1)
alert tcp any any -> any any (msg:"tobit_david"; appid:tobit_david; sid:1000335; rev:1)
alert tcp any any -> any any (msg:"tor"; appid:tor; sid:1000336; rev:1)
alert tcp any any -> any any (msg:"tripwire"; appid:tripwire; sid:1000337; rev:1)
alert tcp any any -> any any (msg:"tumblr"; appid:tumblr; sid:1000338; rev:1)
alert tcp any any -> any any (msg:"uaac"; appid:uaac; sid:1000339; rev:1)
alert tcp any any -> any any (msg:"uarps"; appid:uarps; sid:1000340; rev:1)
alert tcp any any -> any any (msg:"uc4"; appid:uc4; sid:1000341; rev:1)
alert tcp any any -> any any (msg:"uis"; appid:uis; sid:1000342; rev:1)
alert tcp any any -> any any (msg:"listproc"; appid:listproc; sid:1000343; rev:1)
alert tcp any any -> any any (msg:"uma"; appid:uma; sid:1000344; rev:1)
alert tcp any any -> any any (msg:"unicenter"; appid:unicenter; sid:1000345; rev:1)
alert tcp any any -> any any (msg:"unidata_ldm"; appid:unidata_ldm; sid:1000346; rev:1)
alert tcp any any -> any any (msg:"unify"; appid:unify; sid:1000347; rev:1)
alert tcp any any -> any any (msg:"ups"; appid:ups; sid:1000348; rev:1)
alert tcp any any -> any any (msg:"usenet"; appid:usenet; sid:1000349; rev:1)
alert tcp any any -> any any (msg:"uucp"; appid:uucp; sid:1000350; rev:1)
alert tcp any any -> any any (msg:"vchat"; appid:vchat; sid:1000351; rev:1)
alert tcp any any -> any any (msg:"vettcp"; appid:vettcp; sid:1000352; rev:1)
alert tcp any any -> any any (msg:"vmnet"; appid:vmnet; sid:1000353; rev:1)
alert tcp any any -> any any (msg:"vm_pwscs"; appid:vm_pwscs; sid:1000354; rev:1)
alert tcp any any -> any any (msg:"vonage"; appid:vonage; sid:1000355; rev:1)
alert tcp any any -> any any (msg:"vslmp"; appid:vslmp; sid:1000356; rev:1)
alert tcp any any -> any any (msg:"vuze"; appid:vuze; sid:1000357; rev:1)
alert tcp any any -> any any (msg:"wccp"; appid:wccp; sid:1000358; rev:1)
alert tcp any any -> any any (msg:"webfilter"; appid:webfilter; sid:1000359; rev:1)
alert tcp any any -> any any (msg:"weblogic"; appid:weblogic; sid:1000360; rev:1)
alert tcp any any -> any any (msg:"wikipedia"; appid:wikipedia; sid:1000361; rev:1)
alert tcp any any -> any any (msg:"windows_live"; appid:windows_live; sid:1000362; rev:1)
alert tcp any any -> any any (msg:"windows_media"; appid:windows_media; sid:1000363; rev:1)
alert tcp any any -> any any (msg:"nameserver"; appid:nameserver; sid:1000364; rev:1)
alert tcp any any -> any any (msg:"wordpress"; appid:wordpress; sid:1000365; rev:1)
alert tcp any any -> any any (msg:"wowcraft"; appid:wowcraft; sid:1000366; rev:1)
alert tcp any any -> any any (msg:"xanga"; appid:xanga; sid:1000367; rev:1)
alert tcp any any -> any any (msg:"xbone"; appid:xbone; sid:1000368; rev:1)
alert tcp any any -> any any (msg:"xdmcp"; appid:xdmcp; sid:1000369; rev:1)
alert tcp any any -> any any (msg:"xfer"; appid:xfer; sid:1000370; rev:1)
alert tcp any any -> any any (msg:"xns_authentication"; appid:xns_authentication; sid:1000371; rev:1)
alert tcp any any -> any any (msg:"xns_clearinghouse"; appid:xns_clearinghouse; sid:1000372; rev:1)
alert tcp any any -> any any (msg:"xns_mail"; appid:xns_mail; sid:1000373; rev:1)
alert tcp any any -> any any (msg:"xns_time"; appid:xns_time; sid:1000374; rev:1)
alert tcp any any -> any any (msg:"xns"; appid:xns; sid:1000375; rev:1)
alert tcp any any -> any any (msg:"xyplex"; appid:xyplex; sid:1000376; rev:1)
alert tcp any any -> any any (msg:"yahoo_games"; appid:yahoo_games; sid:1000377; rev:1)
alert tcp any any -> any any (msg:"yahoo"; appid:yahoo; sid:1000378; rev:1)
alert tcp any any -> any any (msg:"ansi_z39.50"; appid:ansi_z39.50; sid:1000379; rev:1)
alert tcp any any -> any any (msg:"zannet"; appid:zannet; sid:1000380; rev:1)
alert tcp any any -> any any (msg:"zebra"; appid:zebra; sid:1000381; rev:1)
alert tcp any any -> any any (msg:"zoho"; appid:zoho; sid:1000382; rev:1)
alert tcp any any -> any any (msg:"zoho_chat"; appid:zoho_chat; sid:1000383; rev:1)
alert tcp any any -> any any (msg:"zoho_mail"; appid:zoho_mail; sid:1000384; rev:1)
alert tcp any any -> any any (msg:"zoho_wiki"; appid:zoho_wiki; sid:1000385; rev:1)
alert tcp any any -> any any (msg:"zynga"; appid:zynga; sid:1000386; rev:1)
alert tcp any any -> any any (msg:"1-800-flowers"; appid:1-800-flowers; sid:1000387; rev:1)
alert tcp any any -> any any (msg:"100bao"; appid:100bao; sid:1000388; rev:1)
alert tcp any any -> any any (msg:"2channel"; appid:2channel; sid:1000389; rev:1)
alert tcp any any -> any any (msg:"6.pm"; appid:6.pm; sid:1000390; rev:1)
alert tcp any any -> any any (msg:"ace_hardware"; appid:ace_hardware; sid:1000391; rev:1)
alert tcp any any -> any any (msg:"addicting_games"; appid:addicting_games; sid:1000392; rev:1)
alert tcp any any -> any any (msg:"adobe_software"; appid:adobe_software; sid:1000393; rev:1)
alert tcp any any -> any any (msg:"adorama"; appid:adorama; sid:1000394; rev:1)
alert tcp any any -> any any (msg:"amex"; appid:amex; sid:1000395; rev:1)
alert tcp any any -> any any (msg:"android_browser"; appid:android_browser; sid:1000396; rev:1)
alert tcp any any -> any any (msg:"aol_mail"; appid:aol_mail; sid:1000397; rev:1)
alert tcp any any -> any any (msg:"apple_mail"; appid:apple_mail; sid:1000398; rev:1)
alert tcp any any -> any any (msg:"apple_store"; appid:apple_store; sid:1000399; rev:1)
alert tcp any any -> any any (msg:"arcserve"; appid:arcserve; sid:1000400; rev:1)
alert tcp any any -> any any (msg:"ares"; appid:ares; sid:1000401; rev:1)
alert tcp any any -> any any (msg:"argos"; appid:argos; sid:1000402; rev:1)
alert tcp any any -> any any (msg:"cc_studios"; appid:cc_studios; sid:1000403; rev:1)
alert tcp any any -> any any (msg:"autoblog"; appid:autoblog; sid:1000404; rev:1)
alert tcp any any -> any any (msg:"autotrader.com"; appid:autotrader.com; sid:1000405; rev:1)
alert tcp any any -> any any (msg:"bh_photo_video"; appid:bh_photo_video; sid:1000406; rev:1)
alert tcp any any -> any any (msg:"bank_of_america"; appid:bank_of_america; sid:1000407; rev:1)
alert tcp any any -> any any (msg:"barnes_n_noble"; appid:barnes_n_noble; sid:1000408; rev:1)
alert tcp any any -> any any (msg:"barneys_ny"; appid:barneys_ny; sid:1000409; rev:1)
alert tcp any any -> any any (msg:"basecamp"; appid:basecamp; sid:1000410; rev:1)
alert tcp any any -> any any (msg:"battle_net"; appid:battle_net; sid:1000411; rev:1)
alert tcp any any -> any any (msg:"best_buy"; appid:best_buy; sid:1000412; rev:1)
alert tcp any any -> any any (msg:"bgp"; appid:bgp; sid:1000413; rev:1)
alert tcp any any -> any any (msg:"torrent_tracker"; appid:torrent_tracker; sid:1000414; rev:1)
alert tcp any any -> any any (msg:"black_decker"; appid:black_decker; sid:1000415; rev:1)
alert tcp any any -> any any (msg:"blackberry_browser"; appid:blackberry_browser; sid:1000416; rev:1)
alert tcp any any -> any any (msg:"blip.tv"; appid:blip.tv; sid:1000417; rev:1)
alert tcp any any -> any any (msg:"blockbuster"; appid:blockbuster; sid:1000418; rev:1)
alert tcp any any -> any any (msg:"blogger"; appid:blogger; sid:1000419; rev:1)
alert tcp any any -> any any (msg:"bloomingdales"; appid:bloomingdales; sid:1000420; rev:1)
alert tcp any any -> any any (msg:"blue_nile"; appid:blue_nile; sid:1000421; rev:1)
alert tcp any any -> any any (msg:"bluefly"; appid:bluefly; sid:1000422; rev:1)
alert tcp any any -> any any (msg:"camerasdirect"; appid:camerasdirect; sid:1000423; rev:1)
alert tcp any any -> any any (msg:"capital_one"; appid:capital_one; sid:1000424; rev:1)
alert tcp any any -> any any (msg:"car_and_driver"; appid:car_and_driver; sid:1000425; rev:1)
alert tcp any any -> any any (msg:"carmax"; appid:carmax; sid:1000426; rev:1)
alert tcp any any -> any any (msg:"cdiscount"; appid:cdiscount; sid:1000427; rev:1)
alert tcp any any -> any any (msg:"chargen"; appid:chargen; sid:1000428; rev:1)
alert tcp any any -> any any (msg:"chase"; appid:chase; sid:1000429; rev:1)
alert tcp any any -> any any (msg:"cheaptickets"; appid:cheaptickets; sid:1000430; rev:1)
alert tcp any any -> any any (msg:"chrome"; appid:chrome; sid:1000431; rev:1)
alert tcp any any -> any any (msg:"citi"; appid:citi; sid:1000432; rev:1)
alert tcp any any -> any any (msg:"city_sports"; appid:city_sports; sid:1000433; rev:1)
alert tcp any any -> any any (msg:"collabedit"; appid:collabedit; sid:1000434; rev:1)
alert tcp any any -> any any (msg:"costco"; appid:costco; sid:1000435; rev:1)
alert tcp any any -> any any (msg:"craigslist"; appid:craigslist; sid:1000436; rev:1)
alert tcp any any -> any any (msg:"crutchfield"; appid:crutchfield; sid:1000437; rev:1)
alert tcp any any -> any any (msg:"curl"; appid:curl; sid:1000438; rev:1)
alert tcp any any -> any any (msg:"cvs"; appid:cvs; sid:1000439; rev:1)
alert tcp any any -> any any (msg:"daap"; appid:daap; sid:1000440; rev:1)
alert tcp any any -> any any (msg:"dailymotion"; appid:dailymotion; sid:1000441; rev:1)
alert tcp any any -> any any (msg:"david_jones"; appid:david_jones; sid:1000442; rev:1)
alert tcp any any -> any any (msg:"db2"; appid:db2; sid:1000443; rev:1)
alert tcp any any -> any any (msg:"dcerpc"; appid:dcerpc; sid:1000444; rev:1)
alert tcp any any -> any any (msg:"deals_direct"; appid:deals_direct; sid:1000445; rev:1)
alert tcp any any -> any any (msg:"delicious"; appid:delicious; sid:1000446; rev:1)
alert tcp any any -> any any (msg:"dell"; appid:dell; sid:1000447; rev:1)
alert tcp any any -> any any (msg:"destructoid"; appid:destructoid; sid:1000448; rev:1)
alert tcp any any -> any any (msg:"deviantart"; appid:deviantart; sid:1000449; rev:1)
alert tcp any any -> any any (msg:"dhcp"; appid:dhcp; sid:1000450; rev:1)
alert tcp any any -> any any (msg:"dicks_sporting"; appid:dicks_sporting; sid:1000451; rev:1)
alert tcp any any -> any any (msg:"diigo"; appid:diigo; sid:1000452; rev:1)
alert tcp any any -> any any (msg:"dillards"; appid:dillards; sid:1000453; rev:1)
alert tcp any any -> any any (msg:"discard"; appid:discard; sid:1000454; rev:1)
alert tcp any any -> any any (msg:"discover"; appid:discover; sid:1000455; rev:1)
alert tcp any any -> any any (msg:"dnp3"; appid:dnp3; sid:1000456; rev:1)
alert tcp any any -> any any (msg:"dns"; appid:dns; sid:1000457; rev:1)
alert tcp any any -> any any (msg:"drda"; appid:drda; sid:1000458; rev:1)
alert tcp any any -> any any (msg:"dropbear"; appid:dropbear; sid:1000459; rev:1)
alert tcp any any -> any any (msg:"etrade"; appid:etrade; sid:1000460; rev:1)
alert tcp any any -> any any (msg:"edmunds"; appid:edmunds; sid:1000461; rev:1)
alert tcp any any -> any any (msg:"edonkey"; appid:edonkey; sid:1000462; rev:1)
alert tcp any any -> any any (msg:"eudora"; appid:eudora; sid:1000463; rev:1)
alert tcp any any -> any any (msg:"eudora_pro"; appid:eudora_pro; sid:1000464; rev:1)
alert tcp any any -> any any (msg:"evolution"; appid:evolution; sid:1000465; rev:1)
alert tcp any any -> any any (msg:"exec"; appid:exec; sid:1000466; rev:1)
alert tcp any any -> any any (msg:"expedia"; appid:expedia; sid:1000467; rev:1)
alert tcp any any -> any any (msg:"facebook"; appid:facebook; sid:1000468; rev:1)
alert tcp any any -> any any (msg:"fb_comment"; appid:fb_comment; sid:1000469; rev:1)
alert tcp any any -> any any (msg:"premier_football"; appid:premier_football; sid:1000470; rev:1)
alert tcp any any -> any any (msg:"fidelity"; appid:fidelity; sid:1000471; rev:1)
alert tcp any any -> any any (msg:"finger"; appid:finger; sid:1000472; rev:1)
alert tcp any any -> any any (msg:"firefox"; appid:firefox; sid:1000473; rev:1)
alert tcp any any -> any any (msg:"flash_video"; appid:flash_video; sid:1000474; rev:1)
alert tcp any any -> any any (msg:"fnac"; appid:fnac; sid:1000475; rev:1)
alert tcp any any -> any any (msg:"friendster"; appid:friendster; sid:1000476; rev:1)
alert tcp any any -> any any (msg:"ftd"; appid:ftd; sid:1000477; rev:1)
alert tcp any any -> any any (msg:"g4"; appid:g4; sid:1000478; rev:1)
alert tcp any any -> any any (msg:"game_informer"; appid:game_informer; sid:1000479; rev:1)
alert tcp any any -> any any (msg:"gamespot"; appid:gamespot; sid:1000480; rev:1)
alert tcp any any -> any any (msg:"gamespy"; appid:gamespy; sid:1000481; rev:1)
alert tcp any any -> any any (msg:"gamestop"; appid:gamestop; sid:1000482; rev:1)
alert tcp any any -> any any (msg:"gametrailers"; appid:gametrailers; sid:1000483; rev:1)
alert tcp any any -> any any (msg:"gawker"; appid:gawker; sid:1000484; rev:1)
alert tcp any any -> any any (msg:"gmail"; appid:gmail; sid:1000485; rev:1)
alert tcp any any -> any any (msg:"gnucleuslan"; appid:gnucleuslan; sid:1000486; rev:1)
alert tcp any any -> any any (msg:"gnutella"; appid:gnutella; sid:1000487; rev:1)
alert tcp any any -> any any (msg:"gnutella2"; appid:gnutella2; sid:1000488; rev:1)
alert tcp any any -> any any (msg:"google_analytics"; appid:google_analytics; sid:1000489; rev:1)
alert tcp any any -> any any (msg:"google_calendar"; appid:google_calendar; sid:1000490; rev:1)
alert tcp any any -> any any (msg:"google_news"; appid:google_news; sid:1000491; rev:1)
alert tcp any any -> any any (msg:"google_product_search"; appid:google_product_search; sid:1000492; rev:1)
alert tcp any any -> any any (msg:"google_safebrowsing"; appid:google_safebrowsing; sid:1000493; rev:1)
alert tcp any any -> any any (msg:"gopher"; appid:gopher; sid:1000494; rev:1)
alert tcp any any -> any any (msg:"haiku_learning"; appid:haiku_learning; sid:1000495; rev:1)
alert tcp any any -> any any (msg:"home_depot"; appid:home_depot; sid:1000496; rev:1)
alert tcp any any -> any any (msg:"hostname"; appid:hostname; sid:1000497; rev:1)
alert tcp any any -> any any (msg:"google_earth"; appid:google_earth; sid:1000498; rev:1)
alert tcp any any -> any any (msg:"hotline"; appid:hotline; sid:1000499; rev:1)
alert tcp any any -> any any (msg:"house_of_fraser"; appid:house_of_fraser; sid:1000500; rev:1)
alert tcp any any -> any any (msg:"hsbc"; appid:hsbc; sid:1000501; rev:1)
alert tcp any any -> any any (msg:"http"; appid:http; sid:1000502; rev:1)
alert tcp any any -> any any (msg:"hulu"; appid:hulu; sid:1000503; rev:1)
alert tcp any any -> any any (msg:"ibm_app"; appid:ibm_app; sid:1000504; rev:1)
alert tcp any any -> any any (msg:"icq"; appid:icq; sid:1000505; rev:1)
alert tcp any any -> any any (msg:"ign"; appid:ign; sid:1000506; rev:1)
alert tcp any any -> any any (msg:"imageshack"; appid:imageshack; sid:1000507; rev:1)
alert tcp any any -> any any (msg:"imap"; appid:imap; sid:1000508; rev:1)
alert tcp any any -> any any (msg:"imgur"; appid:imgur; sid:1000509; rev:1)
alert tcp any any -> any any (msg:"imo.im"; appid:imo.im; sid:1000510; rev:1)
alert tcp any any -> any any (msg:"internet_explorer"; appid:internet_explorer; sid:1000511; rev:1)
alert tcp any any -> any any (msg:"ircd"; appid:ircd; sid:1000512; rev:1)
alert tcp any any -> any any (msg:"itu_h.323"; appid:itu_h.323; sid:1000513; rev:1)
alert tcp any any -> any any (msg:"itunes"; appid:itunes; sid:1000514; rev:1)
alert tcp any any -> any any (msg:"jcpenny"; appid:jcpenny; sid:1000515; rev:1)
alert tcp any any -> any any (msg:"jabber"; appid:jabber; sid:1000516; rev:1)
alert tcp any any -> any any (msg:"jalopnik"; appid:jalopnik; sid:1000517; rev:1)
alert tcp any any -> any any (msg:"java_rmi"; appid:java_rmi; sid:1000518; rev:1)
alert tcp any any -> any any (msg:"jira"; appid:jira; sid:1000519; rev:1)
alert tcp any any -> any any (msg:"joystiq"; appid:joystiq; sid:1000520; rev:1)
alert tcp any any -> any any (msg:"kad"; appid:kad; sid:1000521; rev:1)
alert tcp any any -> any any (msg:"kay_jewelers"; appid:kay_jewelers; sid:1000522; rev:1)
alert tcp any any -> any any (msg:"kmail"; appid:kmail; sid:1000523; rev:1)
alert tcp any any -> any any (msg:"kerberos"; appid:kerberos; sid:1000524; rev:1)
alert tcp any any -> any any (msg:"kmart"; appid:kmart; sid:1000525; rev:1)
alert tcp any any -> any any (msg:"kogan_tech"; appid:kogan_tech; sid:1000526; rev:1)
alert tcp any any -> any any (msg:"kohl's"; appid:kohl's; sid:1000527; rev:1)
alert tcp any any -> any any (msg:"kongregate"; appid:kongregate; sid:1000528; rev:1)
alert tcp any any -> any any (msg:"konqueror"; appid:konqueror; sid:1000529; rev:1)
alert tcp any any -> any any (msg:"kotaku"; appid:kotaku; sid:1000530; rev:1)
alert tcp any any -> any any (msg:"launchpad"; appid:launchpad; sid:1000531; rev:1)
alert tcp any any -> any any (msg:"ldap"; appid:ldap; sid:1000532; rev:1)
alert tcp any any -> any any (msg:"limelight"; appid:limelight; sid:1000533; rev:1)
alert tcp any any -> any any (msg:"linkedin"; appid:linkedin; sid:1000534; rev:1)
alert tcp any any -> any any (msg:"linkedin_jobs"; appid:linkedin_jobs; sid:1000535; rev:1)
alert tcp any any -> any any (msg:"linuxconf"; appid:linuxconf; sid:1000536; rev:1)
alert tcp any any -> any any (msg:"livejournal"; appid:livejournal; sid:1000537; rev:1)
alert tcp any any -> any any (msg:"lokalisten"; appid:lokalisten; sid:1000538; rev:1)
alert tcp any any -> any any (msg:"lord_taylor"; appid:lord_taylor; sid:1000539; rev:1)
alert tcp any any -> any any (msg:"lotus_notes"; appid:lotus_notes; sid:1000540; rev:1)
alert tcp any any -> any any (msg:"lowes"; appid:lowes; sid:1000541; rev:1)
alert tcp any any -> any any (msg:"lsh"; appid:lsh; sid:1000542; rev:1)
alert tcp any any -> any any (msg:"manolito"; appid:manolito; sid:1000543; rev:1)
alert tcp any any -> any any (msg:"megaco"; appid:megaco; sid:1000544; rev:1)
alert tcp any any -> any any (msg:"menards"; appid:menards; sid:1000545; rev:1)
alert tcp any any -> any any (msg:"metacafe"; appid:metacafe; sid:1000546; rev:1)
alert tcp any any -> any any (msg:"metafilter"; appid:metafilter; sid:1000547; rev:1)
alert tcp any any -> any any (msg:"mgcp"; appid:mgcp; sid:1000548; rev:1)
alert tcp any any -> any any (msg:"ms_update"; appid:ms_update; sid:1000549; rev:1)
alert tcp any any -> any any (msg:"ms_windows_msgr"; appid:ms_windows_msgr; sid:1000550; rev:1)
alert tcp any any -> any any (msg:"mms"; appid:mms; sid:1000551; rev:1)
alert tcp any any -> any any (msg:"mobile_safari"; appid:mobile_safari; sid:1000552; rev:1)
alert tcp any any -> any any (msg:"modbus"; appid:modbus; sid:1000553; rev:1)
alert tcp any any -> any any (msg:"morgan_stanley"; appid:morgan_stanley; sid:1000554; rev:1)
alert tcp any any -> any any (msg:"msn_messenger"; appid:msn_messenger; sid:1000555; rev:1)
alert tcp any any -> any any (msg:"mute"; appid:mute; sid:1000556; rev:1)
alert tcp any any -> any any (msg:"mutt"; appid:mutt; sid:1000557; rev:1)
alert tcp any any -> any any (msg:"mysql"; appid:mysql; sid:1000558; rev:1)
alert tcp any any -> any any (msg:"myudutu"; appid:myudutu; sid:1000559; rev:1)
alert tcp any any -> any any (msg:"ncp"; appid:ncp; sid:1000560; rev:1)
alert tcp any any -> any any (msg:"neckermann"; appid:neckermann; sid:1000561; rev:1)
alert tcp any any -> any any (msg:"neiman_marcus"; appid:neiman_marcus; sid:1000562; rev:1)
alert tcp any any -> any any (msg:"nessus"; appid:nessus; sid:1000563; rev:1)
alert tcp any any -> any any (msg:"netbios-dgm"; appid:netbios-dgm; sid:1000564; rev:1)
alert tcp any any -> any any (msg:"netbios-ns"; appid:netbios-ns; sid:1000565; rev:1)
alert tcp any any -> any any (msg:"netbios-ssn"; appid:netbios-ssn; sid:1000566; rev:1)
alert tcp any any -> any any (msg:"netflix"; appid:netflix; sid:1000567; rev:1)
alert tcp any any -> any any (msg:"netlog"; appid:netlog; sid:1000568; rev:1)
alert tcp any any -> any any (msg:"netvibes"; appid:netvibes; sid:1000569; rev:1)
alert tcp any any -> any any (msg:"newegg"; appid:newegg; sid:1000570; rev:1)
alert tcp any any -> any any (msg:"newsnow"; appid:newsnow; sid:1000571; rev:1)
alert tcp any any -> any any (msg:"newsvine"; appid:newsvine; sid:1000572; rev:1)
alert tcp any any -> any any (msg:"nico_douga"; appid:nico_douga; sid:1000573; rev:1)
alert tcp any any -> any any (msg:"nntp"; appid:nntp; sid:1000574; rev:1)
alert tcp any any -> any any (msg:"nordstrom"; appid:nordstrom; sid:1000575; rev:1)
alert tcp any any -> any any (msg:"nsplayer"; appid:nsplayer; sid:1000576; rev:1)
alert tcp any any -> any any (msg:"ntalk"; appid:ntalk; sid:1000577; rev:1)
alert tcp any any -> any any (msg:"ntp"; appid:ntp; sid:1000578; rev:1)
alert tcp any any -> any any (msg:"office_depot"; appid:office_depot; sid:1000579; rev:1)
alert tcp any any -> any any (msg:"officemax"; appid:officemax; sid:1000580; rev:1)
alert tcp any any -> any any (msg:"oo.com.au"; appid:oo.com.au; sid:1000581; rev:1)
alert tcp any any -> any any (msg:"openssh"; appid:openssh; sid:1000582; rev:1)
alert tcp any any -> any any (msg:"oracle_database"; appid:oracle_database; sid:1000583; rev:1)
alert tcp any any -> any any (msg:"oracle"; appid:oracle; sid:1000584; rev:1)
alert tcp any any -> any any (msg:"orbitz"; appid:orbitz; sid:1000585; rev:1)
alert tcp any any -> any any (msg:"outlook"; appid:outlook; sid:1000586; rev:1)
alert tcp any any -> any any (msg:"outlook_express"; appid:outlook_express; sid:1000587; rev:1)
alert tcp any any -> any any (msg:"overstock"; appid:overstock; sid:1000588; rev:1)
alert tcp any any -> any any (msg:"pandora"; appid:pandora; sid:1000589; rev:1)
alert tcp any any -> any any (msg:"pc_duo"; appid:pc_duo; sid:1000590; rev:1)
alert tcp any any -> any any (msg:"pcanywhere"; appid:pcanywhere; sid:1000591; rev:1)
alert tcp any any -> any any (msg:"peercast"; appid:peercast; sid:1000592; rev:1)
alert tcp any any -> any any (msg:"peerenabler"; appid:peerenabler; sid:1000593; rev:1)
alert tcp any any -> any any (msg:"photobucket"; appid:photobucket; sid:1000594; rev:1)
alert tcp any any -> any any (msg:"poco"; appid:poco; sid:1000595; rev:1)
alert tcp any any -> any any (msg:"pogo"; appid:pogo; sid:1000596; rev:1)
alert tcp any any -> any any (msg:"pop3"; appid:pop3; sid:1000597; rev:1)
alert tcp any any -> any any (msg:"popcap_games"; appid:popcap_games; sid:1000598; rev:1)
alert tcp any any -> any any (msg:"popurls"; appid:popurls; sid:1000599; rev:1)
alert tcp any any -> any any (msg:"postgresql"; appid:postgresql; sid:1000600; rev:1)
alert tcp any any -> any any (msg:"priceline"; appid:priceline; sid:1000601; rev:1)
alert tcp any any -> any any (msg:"proflowers"; appid:proflowers; sid:1000602; rev:1)
alert tcp any any -> any any (msg:"putty"; appid:putty; sid:1000603; rev:1)
alert tcp any any -> any any (msg:"quake"; appid:quake; sid:1000604; rev:1)
alert tcp any any -> any any (msg:"quill_corp"; appid:quill_corp; sid:1000605; rev:1)
alert tcp any any -> any any (msg:"qvc"; appid:qvc; sid:1000606; rev:1)
alert tcp any any -> any any (msg:"qzone"; appid:qzone; sid:1000607; rev:1)
alert tcp any any -> any any (msg:"radius"; appid:radius; sid:1000608; rev:1)
alert tcp any any -> any any (msg:"radacct"; appid:radacct; sid:1000609; rev:1)
alert tcp any any -> any any (msg:"rdp"; appid:rdp; sid:1000610; rev:1)
alert tcp any any -> any any (msg:"reddit"; appid:reddit; sid:1000611; rev:1)
alert tcp any any -> any any (msg:"redmine"; appid:redmine; sid:1000612; rev:1)
alert tcp any any -> any any (msg:"rei"; appid:rei; sid:1000613; rev:1)
alert tcp any any -> any any (msg:"renren"; appid:renren; sid:1000614; rev:1)
alert tcp any any -> any any (msg:"revolveclothing"; appid:revolveclothing; sid:1000615; rev:1)
alert tcp any any -> any any (msg:"rona"; appid:rona; sid:1000616; rev:1)
alert tcp any any -> any any (msg:"rtmp"; appid:rtmp; sid:1000617; rev:1)
alert tcp any any -> any any (msg:"rtp"; appid:rtp; sid:1000618; rev:1)
alert tcp any any -> any any (msg:"rtsp"; appid:rtsp; sid:1000619; rev:1)
alert tcp any any -> any any (msg:"safari"; appid:safari; sid:1000620; rev:1)
alert tcp any any -> any any (msg:"saks_fifth_ave"; appid:saks_fifth_ave; sid:1000621; rev:1)
alert tcp any any -> any any (msg:"sams_club"; appid:sams_club; sid:1000622; rev:1)
alert tcp any any -> any any (msg:"schuelervz"; appid:schuelervz; sid:1000623; rev:1)
alert tcp any any -> any any (msg:"schwab"; appid:schwab; sid:1000624; rev:1)
alert tcp any any -> any any (msg:"sears"; appid:sears; sid:1000625; rev:1)
alert tcp any any -> any any (msg:"shell"; appid:shell; sid:1000626; rev:1)
alert tcp any any -> any any (msg:"shockwave"; appid:shockwave; sid:1000627; rev:1)
alert tcp any any -> any any (msg:"shoplet"; appid:shoplet; sid:1000628; rev:1)
alert tcp any any -> any any (msg:"shopnbc"; appid:shopnbc; sid:1000629; rev:1)
alert tcp any any -> any any (msg:"hp_store"; appid:hp_store; sid:1000630; rev:1)
alert tcp any any -> any any (msg:"shopstyle"; appid:shopstyle; sid:1000631; rev:1)
alert tcp any any -> any any (msg:"shoutcast_radio"; appid:shoutcast_radio; sid:1000632; rev:1)
alert tcp any any -> any any (msg:"showclix"; appid:showclix; sid:1000633; rev:1)
alert tcp any any -> any any (msg:"showdocument"; appid:showdocument; sid:1000634; rev:1)
alert tcp any any -> any any (msg:"skype"; appid:skype; sid:1000635; rev:1)
alert tcp any any -> any any (msg:"slashdot"; appid:slashdot; sid:1000636; rev:1)
alert tcp any any -> any any (msg:"smtp"; appid:smtp; sid:1000637; rev:1)
alert tcp any any -> any any (msg:"snmp"; appid:snmp; sid:1000638; rev:1)
alert tcp any any -> any any (msg:"socks"; appid:socks; sid:1000639; rev:1)
alert tcp any any -> any any (msg:"soribada"; appid:soribada; sid:1000640; rev:1)
alert tcp any any -> any any (msg:"spin.de"; appid:spin.de; sid:1000641; rev:1)
alert tcp any any -> any any (msg:"sports_auth"; appid:sports_auth; sid:1000642; rev:1)
alert tcp any any -> any any (msg:"sql_server"; appid:sql_server; sid:1000643; rev:1)
alert tcp any any -> any any (msg:"squid"; appid:squid; sid:1000644; rev:1)
alert tcp any any -> any any (msg:"ssh"; appid:ssh; sid:1000645; rev:1)
alert tcp any any -> any any (msg:"ssl"; appid:ssl; sid:1000646; rev:1)
alert tcp any any -> any any (msg:"staples"; appid:staples; sid:1000647; rev:1)
alert tcp any any -> any any (msg:"stayfriends"; appid:stayfriends; sid:1000648; rev:1)
alert tcp any any -> any any (msg:"stubhub"; appid:stubhub; sid:1000649; rev:1)
alert tcp any any -> any any (msg:"studivz"; appid:studivz; sid:1000650; rev:1)
alert tcp any any -> any any (msg:"stumbleupon"; appid:stumbleupon; sid:1000651; rev:1)
alert tcp any any -> any any (msg:"stun"; appid:stun; sid:1000652; rev:1)
alert tcp any any -> any any (msg:"swarovski"; appid:swarovski; sid:1000653; rev:1)
alert tcp any any -> any any (msg:"troweprice"; appid:troweprice; sid:1000654; rev:1)
alert tcp any any -> any any (msg:"tds"; appid:tds; sid:1000655; rev:1)
alert tcp any any -> any any (msg:"talk"; appid:talk; sid:1000656; rev:1)
alert tcp any any -> any any (msg:"target"; appid:target; sid:1000657; rev:1)
alert tcp any any -> any any (msg:"tchibo"; appid:tchibo; sid:1000658; rev:1)
alert tcp any any -> any any (msg:"td_ameritrade"; appid:td_ameritrade; sid:1000659; rev:1)
alert tcp any any -> any any (msg:"telnet"; appid:telnet; sid:1000660; rev:1)
alert tcp any any -> any any (msg:"tftp"; appid:tftp; sid:1000661; rev:1)
alert tcp any any -> any any (msg:"gapstores"; appid:gapstores; sid:1000662; rev:1)
alert tcp any any -> any any (msg:"sharper_image"; appid:sharper_image; sid:1000663; rev:1)
alert tcp any any -> any any (msg:"thunderbird"; appid:thunderbird; sid:1000664; rev:1)
alert tcp any any -> any any (msg:"ticketmaster"; appid:ticketmaster; sid:1000665; rev:1)
alert tcp any any -> any any (msg:"tickets"; appid:tickets; sid:1000666; rev:1)
alert tcp any any -> any any (msg:"tiffany"; appid:tiffany; sid:1000667; rev:1)
alert tcp any any -> any any (msg:"tiger_direct"; appid:tiger_direct; sid:1000668; rev:1)
alert tcp any any -> any any (msg:"timbuktu"; appid:timbuktu; sid:1000669; rev:1)
alert tcp any any -> any any (msg:"tinypic"; appid:tinypic; sid:1000670; rev:1)
alert tcp any any -> any any (msg:"tivoli"; appid:tivoli; sid:1000671; rev:1)
alert tcp any any -> any any (msg:"toc"; appid:toc; sid:1000672; rev:1)
alert tcp any any -> any any (msg:"top_gear"; appid:top_gear; sid:1000673; rev:1)
alert tcp any any -> any any (msg:"trac"; appid:trac; sid:1000674; rev:1)
alert tcp any any -> any any (msg:"travelocity"; appid:travelocity; sid:1000675; rev:1)
alert tcp any any -> any any (msg:"tripadvisor"; appid:tripadvisor; sid:1000676; rev:1)
alert tcp any any -> any any (msg:"twitter"; appid:twitter; sid:1000677; rev:1)
alert tcp any any -> any any (msg:"urban_outfitters"; appid:urban_outfitters; sid:1000678; rev:1)
alert tcp any any -> any any (msg:"ustream.tv"; appid:ustream.tv; sid:1000679; rev:1)
alert tcp any any -> any any (msg:"vanguard"; appid:vanguard; sid:1000680; rev:1)
alert tcp any any -> any any (msg:"vcom"; appid:vcom; sid:1000681; rev:1)
alert tcp any any -> any any (msg:"vente-privee.com"; appid:vente-privee.com; sid:1000682; rev:1)
alert tcp any any -> any any (msg:"veoh"; appid:veoh; sid:1000683; rev:1)
alert tcp any any -> any any (msg:"verizon_email"; appid:verizon_email; sid:1000684; rev:1)
alert tcp any any -> any any (msg:"viadeo"; appid:viadeo; sid:1000685; rev:1)
alert tcp any any -> any any (msg:"victoria_secret"; appid:victoria_secret; sid:1000686; rev:1)
alert tcp any any -> any any (msg:"vimeo"; appid:vimeo; sid:1000687; rev:1)
alert tcp any any -> any any (msg:"vnc"; appid:vnc; sid:1000688; rev:1)
alert tcp any any -> any any (msg:"vnc-server"; appid:vnc-server; sid:1000689; rev:1)
alert tcp any any -> any any (msg:"docstor"; appid:docstor; sid:1000690; rev:1)
alert tcp any any -> any any (msg:"voyages-sncf"; appid:voyages-sncf; sid:1000691; rev:1)
alert tcp any any -> any any (msg:"walmart"; appid:walmart; sid:1000692; rev:1)
alert tcp any any -> any any (msg:"web_of_trust"; appid:web_of_trust; sid:1000693; rev:1)
alert tcp any any -> any any (msg:"webex"; appid:webex; sid:1000694; rev:1)
alert tcp any any -> any any (msg:"websphere_mq"; appid:websphere_mq; sid:1000695; rev:1)
alert tcp any any -> any any (msg:"wells_fargo"; appid:wells_fargo; sid:1000696; rev:1)
alert tcp any any -> any any (msg:"wer-kennt-wen"; appid:wer-kennt-wen; sid:1000697; rev:1)
alert tcp any any -> any any (msg:"wget"; appid:wget; sid:1000698; rev:1)
alert tcp any any -> any any (msg:"zynga_poker"; appid:zynga_poker; sid:1000699; rev:1)
alert tcp any any -> any any (msg:"skydrive"; appid:skydrive; sid:1000700; rev:1)
alert tcp any any -> any any (msg:"windows_media_player"; appid:windows_media_player; sid:1000701; rev:1)
alert tcp any any -> any any (msg:"winmx"; appid:winmx; sid:1000702; rev:1)
alert tcp any any -> any any (msg:"wiziq"; appid:wiziq; sid:1000703; rev:1)
alert tcp any any -> any any (msg:"woot"; appid:woot; sid:1000704; rev:1)
alert tcp any any -> any any (msg:"wx"; appid:wx; sid:1000705; rev:1)
alert tcp any any -> any any (msg:"font-service"; appid:font-service; sid:1000706; rev:1)
alert tcp any any -> any any (msg:"xbox_live"; appid:xbox_live; sid:1000707; rev:1)
alert tcp any any -> any any (msg:"xing"; appid:xing; sid:1000708; rev:1)
alert tcp any any -> any any (msg:"xm_radio_online"; appid:xm_radio_online; sid:1000709; rev:1)
alert tcp any any -> any any (msg:"xunlei"; appid:xunlei; sid:1000710; rev:1)
alert tcp any any -> any any (msg:"x11"; appid:x11; sid:1000711; rev:1)
alert tcp any any -> any any (msg:"yahoo!_voice"; appid:yahoo!_voice; sid:1000712; rev:1)
alert tcp any any -> any any (msg:"yet_abc"; appid:yet_abc; sid:1000713; rev:1)
alert tcp any any -> any any (msg:"hightail"; appid:hightail; sid:1000714; rev:1)
alert tcp any any -> any any (msg:"youtube"; appid:youtube; sid:1000715; rev:1)
alert tcp any any -> any any (msg:"zales"; appid:zales; sid:1000716; rev:1)
alert tcp any any -> any any (msg:"zappos"; appid:zappos; sid:1000717; rev:1)
alert tcp any any -> any any (msg:"zip.ca"; appid:zip.ca; sid:1000718; rev:1)
alert tcp any any -> any any (msg:"cisco_secure_endpoint"; appid:cisco_secure_endpoint; sid:1000719; rev:1)
alert tcp any any -> any any (msg:"yahoo_messenger"; appid:yahoo_messenger; sid:1000720; rev:1)
alert tcp any any -> any any (msg:"googlebot"; appid:googlebot; sid:1000721; rev:1)
alert tcp any any -> any any (msg:"yelp"; appid:yelp; sid:1000722; rev:1)
alert tcp any any -> any any (msg:"netflix_stream"; appid:netflix_stream; sid:1000723; rev:1)
alert tcp any any -> any any (msg:"yahoo_slurp"; appid:yahoo_slurp; sid:1000724; rev:1)
alert tcp any any -> any any (msg:"bingbot"; appid:bingbot; sid:1000725; rev:1)
alert tcp any any -> any any (msg:"yahoo_mail"; appid:yahoo_mail; sid:1000726; rev:1)
alert tcp any any -> any any (msg:"yahoo_toolbar"; appid:yahoo_toolbar; sid:1000727; rev:1)
alert tcp any any -> any any (msg:"4shared"; appid:4shared; sid:1000728; rev:1)
alert tcp any any -> any any (msg:"salesforce"; appid:salesforce; sid:1000729; rev:1)
alert tcp any any -> any any (msg:"ritzcamera.com"; appid:ritzcamera.com; sid:1000730; rev:1)
alert tcp any any -> any any (msg:"macys"; appid:macys; sid:1000731; rev:1)
alert tcp any any -> any any (msg:"whois"; appid:whois; sid:1000732; rev:1)
alert tcp any any -> any any (msg:"echo"; appid:echo; sid:1000733; rev:1)
alert tcp any any -> any any (msg:"daytime"; appid:daytime; sid:1000734; rev:1)
alert tcp any any -> any any (msg:"ident"; appid:ident; sid:1000735; rev:1)
alert tcp any any -> any any (msg:"pando"; appid:pando; sid:1000736; rev:1)
alert tcp any any -> any any (msg:"teamviewer"; appid:teamviewer; sid:1000737; rev:1)
alert tcp any any -> any any (msg:"7digital"; appid:7digital; sid:1000738; rev:1)
alert tcp any any -> any any (msg:"chatroulette"; appid:chatroulette; sid:1000739; rev:1)
alert tcp any any -> any any (msg:"cyworld"; appid:cyworld; sid:1000740; rev:1)
alert tcp any any -> any any (msg:"daum"; appid:daum; sid:1000741; rev:1)
alert tcp any any -> any any (msg:"deezer"; appid:deezer; sid:1000742; rev:1)
alert tcp any any -> any any (msg:"divshare"; appid:divshare; sid:1000743; rev:1)
alert tcp any any -> any any (msg:"dl.free.fr"; appid:dl.free.fr; sid:1000744; rev:1)
alert tcp any any -> any any (msg:"evony"; appid:evony; sid:1000745; rev:1)
alert tcp any any -> any any (msg:"filedropper"; appid:filedropper; sid:1000746; rev:1)
alert tcp any any -> any any (msg:"filemail"; appid:filemail; sid:1000747; rev:1)
alert tcp any any -> any any (msg:"fileserve"; appid:fileserve; sid:1000748; rev:1)
alert tcp any any -> any any (msg:"licorize"; appid:licorize; sid:1000749; rev:1)
alert tcp any any -> any any (msg:"folkd"; appid:folkd; sid:1000750; rev:1)
alert tcp any any -> any any (msg:"fora.tv"; appid:fora.tv; sid:1000751; rev:1)
alert tcp any any -> any any (msg:"gmx_mail"; appid:gmx_mail; sid:1000752; rev:1)
alert tcp any any -> any any (msg:"citeulike"; appid:citeulike; sid:1000753; rev:1)
alert tcp any any -> any any (msg:"habbo"; appid:habbo; sid:1000754; rev:1)
alert tcp any any -> any any (msg:"hushmail"; appid:hushmail; sid:1000755; rev:1)
alert tcp any any -> any any (msg:"hype_machine"; appid:hype_machine; sid:1000756; rev:1)
alert tcp any any -> any any (msg:"iheartradio"; appid:iheartradio; sid:1000757; rev:1)
alert tcp any any -> any any (msg:"issuu"; appid:issuu; sid:1000758; rev:1)
alert tcp any any -> any any (msg:"jamendo"; appid:jamendo; sid:1000759; rev:1)
alert tcp any any -> any any (msg:"jango"; appid:jango; sid:1000760; rev:1)
alert tcp any any -> any any (msg:"justin.tv"; appid:justin.tv; sid:1000761; rev:1)
alert tcp any any -> any any (msg:"kaixin001"; appid:kaixin001; sid:1000762; rev:1)
alert tcp any any -> any any (msg:"livestream"; appid:livestream; sid:1000763; rev:1)
alert tcp any any -> any any (msg:"me2day"; appid:me2day; sid:1000764; rev:1)
alert tcp any any -> any any (msg:"megashare"; appid:megashare; sid:1000765; rev:1)
alert tcp any any -> any any (msg:"mydownloader"; appid:mydownloader; sid:1000766; rev:1)
alert tcp any any -> any any (msg:"neopets"; appid:neopets; sid:1000767; rev:1)
alert tcp any any -> any any (msg:"omegle"; appid:omegle; sid:1000768; rev:1)
alert tcp any any -> any any (msg:"mister_wong"; appid:mister_wong; sid:1000769; rev:1)
alert tcp any any -> any any (msg:"proxeasy"; appid:proxeasy; sid:1000770; rev:1)
alert tcp any any -> any any (msg:"qriocity"; appid:qriocity; sid:1000771; rev:1)
alert tcp any any -> any any (msg:"runescape"; appid:runescape; sid:1000772; rev:1)
alert tcp any any -> any any (msg:"scribd"; appid:scribd; sid:1000773; rev:1)
alert tcp any any -> any any (msg:"songza"; appid:songza; sid:1000774; rev:1)
alert tcp any any -> any any (msg:"soundcloud"; appid:soundcloud; sid:1000775; rev:1)
alert tcp any any -> any any (msg:"surrogafier"; appid:surrogafier; sid:1000776; rev:1)
alert tcp any any -> any any (msg:"tinychat"; appid:tinychat; sid:1000777; rev:1)
alert tcp any any -> any any (msg:"tudou"; appid:tudou; sid:1000778; rev:1)
alert tcp any any -> any any (msg:"transferbigfiles.com"; appid:transferbigfiles.com; sid:1000779; rev:1)
alert tcp any any -> any any (msg:"tuenti"; appid:tuenti; sid:1000780; rev:1)
alert tcp any any -> any any (msg:"vkontakte"; appid:vkontakte; sid:1000781; rev:1)
alert tcp any any -> any any (msg:"vtunnel"; appid:vtunnel; sid:1000782; rev:1)
alert tcp any any -> any any (msg:"webhard"; appid:webhard; sid:1000783; rev:1)
alert tcp any any -> any any (msg:"webshots"; appid:webshots; sid:1000784; rev:1)
alert tcp any any -> any any (msg:"weibo"; appid:weibo; sid:1000785; rev:1)
alert tcp any any -> any any (msg:"woome"; appid:woome; sid:1000786; rev:1)
alert tcp any any -> any any (msg:"bigupload"; appid:bigupload; sid:1000787; rev:1)
alert tcp any any -> any any (msg:"clarizen"; appid:clarizen; sid:1000788; rev:1)
alert tcp any any -> any any (msg:"56.com"; appid:56.com; sid:1000789; rev:1)
alert tcp any any -> any any (msg:"51.com"; appid:51.com; sid:1000790; rev:1)
alert tcp any any -> any any (msg:"youku"; appid:youku; sid:1000791; rev:1)
alert tcp any any -> any any (msg:"crackle"; appid:crackle; sid:1000792; rev:1)
alert tcp any any -> any any (msg:"rutube"; appid:rutube; sid:1000793; rev:1)
alert tcp any any -> any any (msg:"afreeca"; appid:afreeca; sid:1000794; rev:1)
alert tcp any any -> any any (msg:"babelgum"; appid:babelgum; sid:1000795; rev:1)
alert tcp any any -> any any (msg:"mog"; appid:mog; sid:1000796; rev:1)
alert tcp any any -> any any (msg:"phanfare"; appid:phanfare; sid:1000797; rev:1)
alert tcp any any -> any any (msg:"filmon"; appid:filmon; sid:1000798; rev:1)
alert tcp any any -> any any (msg:"mibbit"; appid:mibbit; sid:1000799; rev:1)
alert tcp any any -> any any (msg:"bigbluebutton"; appid:bigbluebutton; sid:1000800; rev:1)
alert tcp any any -> any any (msg:"twitchtv"; appid:twitchtv; sid:1000801; rev:1)
alert tcp any any -> any any (msg:"megameeting"; appid:megameeting; sid:1000802; rev:1)
alert tcp any any -> any any (msg:"badoo"; appid:badoo; sid:1000803; rev:1)
alert tcp any any -> any any (msg:"depositfiles"; appid:depositfiles; sid:1000804; rev:1)
alert tcp any any -> any any (msg:"cloudme"; appid:cloudme; sid:1000805; rev:1)
alert tcp any any -> any any (msg:"skyrock"; appid:skyrock; sid:1000806; rev:1)
alert tcp any any -> any any (msg:"jubii"; appid:jubii; sid:1000807; rev:1)
alert tcp any any -> any any (msg:"twitpic"; appid:twitpic; sid:1000808; rev:1)
alert tcp any any -> any any (msg:"yfrog"; appid:yfrog; sid:1000809; rev:1)
alert tcp any any -> any any (msg:"tagged"; appid:tagged; sid:1000810; rev:1)
alert tcp any any -> any any (msg:"hi5"; appid:hi5; sid:1000811; rev:1)
alert tcp any any -> any any (msg:"livemocha"; appid:livemocha; sid:1000812; rev:1)
alert tcp any any -> any any (msg:"slacker"; appid:slacker; sid:1000813; rev:1)
alert tcp any any -> any any (msg:"douban"; appid:douban; sid:1000814; rev:1)
alert tcp any any -> any any (msg:"odnoklassniki"; appid:odnoklassniki; sid:1000815; rev:1)
alert tcp any any -> any any (msg:"gaia_online"; appid:gaia_online; sid:1000816; rev:1)
alert tcp any any -> any any (msg:"myheritage"; appid:myheritage; sid:1000817; rev:1)
alert tcp any any -> any any (msg:"autozone"; appid:autozone; sid:1000818; rev:1)
alert tcp any any -> any any (msg:"dangdang"; appid:dangdang; sid:1000819; rev:1)
alert tcp any any -> any any (msg:"insight"; appid:insight; sid:1000820; rev:1)
alert tcp any any -> any any (msg:"ical"; appid:ical; sid:1000821; rev:1)
alert tcp any any -> any any (msg:"tesco.com"; appid:tesco.com; sid:1000822; rev:1)
alert tcp any any -> any any (msg:"xda-developers"; appid:xda-developers; sid:1000823; rev:1)
alert tcp any any -> any any (msg:"4chan"; appid:4chan; sid:1000824; rev:1)
alert tcp any any -> any any (msg:"neogaf"; appid:neogaf; sid:1000825; rev:1)
alert tcp any any -> any any (msg:"rhapsody"; appid:rhapsody; sid:1000826; rev:1)
alert tcp any any -> any any (msg:"balatarin"; appid:balatarin; sid:1000827; rev:1)
alert tcp any any -> any any (msg:"movieclips"; appid:movieclips; sid:1000828; rev:1)
alert tcp any any -> any any (msg:"rdt"; appid:rdt; sid:1000829; rev:1)
alert tcp any any -> any any (msg:"steam"; appid:steam; sid:1000830; rev:1)
alert tcp any any -> any any (msg:"9p"; appid:9p; sid:1000831; rev:1)
alert tcp any any -> any any (msg:"msdp"; appid:msdp; sid:1000832; rev:1)
alert tcp any any -> any any (msg:"realaudio"; appid:realaudio; sid:1000833; rev:1)
alert tcp any any -> any any (msg:"teamspeak"; appid:teamspeak; sid:1000834; rev:1)
alert tcp any any -> any any (msg:"ventrilo"; appid:ventrilo; sid:1000835; rev:1)
alert tcp any any -> any any (msg:"winamp"; appid:winamp; sid:1000836; rev:1)
alert tcp any any -> any any (msg:"apt"; appid:apt; sid:1000837; rev:1)
alert tcp any any -> any any (msg:"iwarp"; appid:iwarp; sid:1000838; rev:1)
alert tcp any any -> any any (msg:"ipp"; appid:ipp; sid:1000839; rev:1)
alert tcp any any -> any any (msg:"ndmp"; appid:ndmp; sid:1000840; rev:1)
alert tcp any any -> any any (msg:"rsync"; appid:rsync; sid:1000841; rev:1)
alert tcp any any -> any any (msg:"opc"; appid:opc; sid:1000842; rev:1)
alert tcp any any -> any any (msg:"paltalkfilexfer"; appid:paltalkfilexfer; sid:1000843; rev:1)
alert tcp any any -> any any (msg:"windows_update"; appid:windows_update; sid:1000844; rev:1)
alert tcp any any -> any any (msg:"imo"; appid:imo; sid:1000845; rev:1)
alert tcp any any -> any any (msg:"pc_connection"; appid:pc_connection; sid:1000846; rev:1)
alert tcp any any -> any any (msg:"asf"; appid:asf; sid:1000847; rev:1)
alert tcp any any -> any any (msg:"ddm_ssl"; appid:ddm_ssl; sid:1000848; rev:1)
alert tcp any any -> any any (msg:"smtps"; appid:smtps; sid:1000849; rev:1)
alert tcp any any -> any any (msg:"nntps"; appid:nntps; sid:1000850; rev:1)
alert tcp any any -> any any (msg:"imaps"; appid:imaps; sid:1000851; rev:1)
alert tcp any any -> any any (msg:"sshell"; appid:sshell; sid:1000852; rev:1)
alert tcp any any -> any any (msg:"ldaps"; appid:ldaps; sid:1000853; rev:1)
alert tcp any any -> any any (msg:"telnets"; appid:telnets; sid:1000854; rev:1)
alert tcp any any -> any any (msg:"ircs"; appid:ircs; sid:1000855; rev:1)
alert tcp any any -> any any (msg:"pop3s"; appid:pop3s; sid:1000856; rev:1)
alert tcp any any -> any any (msg:"msgblcatsec"; appid:msgblcatsec; sid:1000857; rev:1)
alert tcp any any -> any any (msg:"sf_mgmt"; appid:sf_mgmt; sid:1000858; rev:1)
alert tcp any any -> any any (msg:"https"; appid:https; sid:1000859; rev:1)
alert tcp any any -> any any (msg:"tweet"; appid:tweet; sid:1000860; rev:1)
alert tcp any any -> any any (msg:"adobe_connect"; appid:adobe_connect; sid:1000861; rev:1)
alert tcp any any -> any any (msg:"bittornado"; appid:bittornado; sid:1000862; rev:1)
alert tcp any any -> any any (msg:"cafemom"; appid:cafemom; sid:1000863; rev:1)
alert tcp any any -> any any (msg:"metacrawler"; appid:metacrawler; sid:1000864; rev:1)
alert tcp any any -> any any (msg:"mininova"; appid:mininova; sid:1000865; rev:1)
alert tcp any any -> any any (msg:"paypal"; appid:paypal; sid:1000866; rev:1)
alert tcp any any -> any any (msg:"pinterest"; appid:pinterest; sid:1000867; rev:1)
alert tcp any any -> any any (msg:"pirate_bay"; appid:pirate_bay; sid:1000868; rev:1)
alert tcp any any -> any any (msg:"technorati"; appid:technorati; sid:1000869; rev:1)
alert tcp any any -> any any (msg:"torrentz"; appid:torrentz; sid:1000870; rev:1)
alert tcp any any -> any any (msg:"typepad"; appid:typepad; sid:1000871; rev:1)
alert tcp any any -> any any (msg:"hotspot_shield"; appid:hotspot_shield; sid:1000872; rev:1)
alert tcp any any -> any any (msg:"zabbix"; appid:zabbix; sid:1000873; rev:1)
alert tcp any any -> any any (msg:"zabbix_trap"; appid:zabbix_trap; sid:1000874; rev:1)
alert tcp any any -> any any (msg:"whatsapp"; appid:whatsapp; sid:1000875; rev:1)
alert tcp any any -> any any (msg:"munin"; appid:munin; sid:1000876; rev:1)
alert tcp any any -> any any (msg:"asproxy"; appid:asproxy; sid:1000877; rev:1)
alert tcp any any -> any any (msg:"google_toolbar"; appid:google_toolbar; sid:1000878; rev:1)
alert tcp any any -> any any (msg:"dyngate"; appid:dyngate; sid:1000879; rev:1)
alert tcp any any -> any any (msg:"pinger"; appid:pinger; sid:1000880; rev:1)
alert tcp any any -> any any (msg:"line2"; appid:line2; sid:1000881; rev:1)
alert tcp any any -> any any (msg:"sccm"; appid:sccm; sid:1000882; rev:1)
alert tcp any any -> any any (msg:"steam_social_networking"; appid:steam_social_networking; sid:1000883; rev:1)
alert tcp any any -> any any (msg:"hamachi"; appid:hamachi; sid:1000884; rev:1)
alert tcp any any -> any any (msg:"spotify"; appid:spotify; sid:1000885; rev:1)
alert tcp any any -> any any (msg:"bubble_witch"; appid:bubble_witch; sid:1000886; rev:1)
alert tcp any any -> any any (msg:"angry_birds"; appid:angry_birds; sid:1000887; rev:1)
alert tcp any any -> any any (msg:"words_friends"; appid:words_friends; sid:1000888; rev:1)
alert tcp any any -> any any (msg:"cityville"; appid:cityville; sid:1000889; rev:1)
alert tcp any any -> any any (msg:"about.com"; appid:about.com; sid:1000890; rev:1)
alert tcp any any -> any any (msg:"answers.com"; appid:answers.com; sid:1000891; rev:1)
alert tcp any any -> any any (msg:"classmates"; appid:classmates; sid:1000892; rev:1)
alert tcp any any -> any any (msg:"cnet"; appid:cnet; sid:1000893; rev:1)
alert tcp any any -> any any (msg:"cnet_download"; appid:cnet_download; sid:1000894; rev:1)
alert tcp any any -> any any (msg:"domaintools"; appid:domaintools; sid:1000895; rev:1)
alert tcp any any -> any any (msg:"ibm"; appid:ibm; sid:1000896; rev:1)
alert tcp any any -> any any (msg:"open_webmail"; appid:open_webmail; sid:1000897; rev:1)
alert tcp any any -> any any (msg:"slideshare"; appid:slideshare; sid:1000898; rev:1)
alert tcp any any -> any any (msg:"sourceforge"; appid:sourceforge; sid:1000899; rev:1)
alert tcp any any -> any any (msg:"surveymonkey"; appid:surveymonkey; sid:1000900; rev:1)
alert tcp any any -> any any (msg:"w3schools.com"; appid:w3schools.com; sid:1000901; rev:1)
alert tcp any any -> any any (msg:"weebly"; appid:weebly; sid:1000902; rev:1)
alert tcp any any -> any any (msg:"google_maps"; appid:google_maps; sid:1000903; rev:1)
alert tcp any any -> any any (msg:"apns"; appid:apns; sid:1000904; rev:1)
alert tcp any any -> any any (msg:"apple_sites"; appid:apple_sites; sid:1000905; rev:1)
alert tcp any any -> any any (msg:"icloud"; appid:icloud; sid:1000906; rev:1)
alert tcp any any -> any any (msg:"pcoip"; appid:pcoip; sid:1000907; rev:1)
alert tcp any any -> any any (msg:"cnn"; appid:cnn; sid:1000908; rev:1)
alert tcp any any -> any any (msg:"imdb"; appid:imdb; sid:1000909; rev:1)
alert tcp any any -> any any (msg:"nbc_news"; appid:nbc_news; sid:1000910; rev:1)
alert tcp any any -> any any (msg:"mint"; appid:mint; sid:1000911; rev:1)
alert tcp any any -> any any (msg:"apple_trailers"; appid:apple_trailers; sid:1000912; rev:1)
alert tcp any any -> any any (msg:"dictionary"; appid:dictionary; sid:1000913; rev:1)
alert tcp any any -> any any (msg:"bild.de"; appid:bild.de; sid:1000914; rev:1)
alert tcp any any -> any any (msg:"bing_maps"; appid:bing_maps; sid:1000915; rev:1)
alert tcp any any -> any any (msg:"google_finance"; appid:google_finance; sid:1000916; rev:1)
alert tcp any any -> any any (msg:"12306.cn"; appid:12306.cn; sid:1000917; rev:1)
alert tcp any any -> any any (msg:"126.com"; appid:126.com; sid:1000918; rev:1)
alert tcp any any -> any any (msg:"39.net"; appid:39.net; sid:1000919; rev:1)
alert tcp any any -> any any (msg:"aizhan"; appid:aizhan; sid:1000920; rev:1)
alert tcp any any -> any any (msg:"bet365"; appid:bet365; sid:1000921; rev:1)
alert tcp any any -> any any (msg:"brothersoft"; appid:brothersoft; sid:1000922; rev:1)
alert tcp any any -> any any (msg:"brighttalk"; appid:brighttalk; sid:1000923; rev:1)
alert tcp any any -> any any (msg:"enet"; appid:enet; sid:1000924; rev:1)
alert tcp any any -> any any (msg:"envato"; appid:envato; sid:1000925; rev:1)
alert tcp any any -> any any (msg:"extratorrent"; appid:extratorrent; sid:1000926; rev:1)
alert tcp any any -> any any (msg:"glype_proxy"; appid:glype_proxy; sid:1000927; rev:1)
alert tcp any any -> any any (msg:"goo.ne.jp"; appid:goo.ne.jp; sid:1000928; rev:1)
alert tcp any any -> any any (msg:"image_venue"; appid:image_venue; sid:1000929; rev:1)
alert tcp any any -> any any (msg:"leboncoin"; appid:leboncoin; sid:1000930; rev:1)
alert tcp any any -> any any (msg:"multiupload"; appid:multiupload; sid:1000931; rev:1)
alert tcp any any -> any any (msg:"netease"; appid:netease; sid:1000932; rev:1)
alert tcp any any -> any any (msg:"online_file_folder"; appid:online_file_folder; sid:1000933; rev:1)
alert tcp any any -> any any (msg:"putlocker"; appid:putlocker; sid:1000934; rev:1)
alert tcp any any -> any any (msg:"raging_bull"; appid:raging_bull; sid:1000935; rev:1)
alert tcp any any -> any any (msg:"soku"; appid:soku; sid:1000936; rev:1)
alert tcp any any -> any any (msg:"theme_forest"; appid:theme_forest; sid:1000937; rev:1)
alert tcp any any -> any any (msg:"webs"; appid:webs; sid:1000938; rev:1)
alert tcp any any -> any any (msg:"bejeweled_chrome_extension"; appid:bejeweled_chrome_extension; sid:1000939; rev:1)
alert tcp any any -> any any (msg:"gplay_books"; appid:gplay_books; sid:1000940; rev:1)
alert tcp any any -> any any (msg:"gplay_music"; appid:gplay_music; sid:1000941; rev:1)
alert tcp any any -> any any (msg:"google_reader"; appid:google_reader; sid:1000942; rev:1)
alert tcp any any -> any any (msg:"instagram"; appid:instagram; sid:1000943; rev:1)
alert tcp any any -> any any (msg:"doubledowncasino"; appid:doubledowncasino; sid:1000944; rev:1)
alert tcp any any -> any any (msg:"iastrology"; appid:iastrology; sid:1000945; rev:1)
alert tcp any any -> any any (msg:"social_empires"; appid:social_empires; sid:1000946; rev:1)
alert tcp any any -> any any (msg:"daily_horoscope"; appid:daily_horoscope; sid:1000947; rev:1)
alert tcp any any -> any any (msg:"slotomania"; appid:slotomania; sid:1000948; rev:1)
alert tcp any any -> any any (msg:"bubble_saga"; appid:bubble_saga; sid:1000949; rev:1)
alert tcp any any -> any any (msg:"branchout"; appid:branchout; sid:1000950; rev:1)
alert tcp any any -> any any (msg:"bejeweled_blitz"; appid:bejeweled_blitz; sid:1000951; rev:1)
alert tcp any any -> any any (msg:"4399.com"; appid:4399.com; sid:1000952; rev:1)
alert tcp any any -> any any (msg:"adf.ly"; appid:adf.ly; sid:1000953; rev:1)
alert tcp any any -> any any (msg:"admin5"; appid:admin5; sid:1000954; rev:1)
alert tcp any any -> any any (msg:"bloomberg"; appid:bloomberg; sid:1000955; rev:1)
alert tcp any any -> any any (msg:"mozilla"; appid:mozilla; sid:1000956; rev:1)
alert tcp any any -> any any (msg:"wretch"; appid:wretch; sid:1000957; rev:1)
alert tcp any any -> any any (msg:"y8"; appid:y8; sid:1000958; rev:1)
alert tcp any any -> any any (msg:"avast"; appid:avast; sid:1000959; rev:1)
alert tcp any any -> any any (msg:"allmyapps"; appid:allmyapps; sid:1000960; rev:1)
alert tcp any any -> any any (msg:"evernote"; appid:evernote; sid:1000961; rev:1)
alert tcp any any -> any any (msg:"seamonkey"; appid:seamonkey; sid:1000962; rev:1)
alert tcp any any -> any any (msg:"fb_search"; appid:fb_search; sid:1000963; rev:1)
alert tcp any any -> any any (msg:"fb_event"; appid:fb_event; sid:1000964; rev:1)
alert tcp any any -> any any (msg:"fb_post"; appid:fb_post; sid:1000965; rev:1)
alert tcp any any -> any any (msg:"fb_video_chat"; appid:fb_video_chat; sid:1000966; rev:1)
alert tcp any any -> any any (msg:"fb_message"; appid:fb_message; sid:1000967; rev:1)
alert tcp any any -> any any (msg:"fb_video"; appid:fb_video; sid:1000968; rev:1)
alert tcp any any -> any any (msg:"opera"; appid:opera; sid:1000969; rev:1)
alert tcp any any -> any any (msg:"adobeair"; appid:adobeair; sid:1000970; rev:1)
alert tcp any any -> any any (msg:"ssl_client"; appid:ssl_client; sid:1000971; rev:1)
alert tcp any any -> any any (msg:"wooga"; appid:wooga; sid:1000972; rev:1)
alert tcp any any -> any any (msg:"nytimes"; appid:nytimes; sid:1000973; rev:1)
alert tcp any any -> any any (msg:"twitter_link"; appid:twitter_link; sid:1000974; rev:1)
alert tcp any any -> any any (msg:"yahoo_finance"; appid:yahoo_finance; sid:1000975; rev:1)
alert tcp any any -> any any (msg:"silverlight"; appid:silverlight; sid:1000976; rev:1)
alert tcp any any -> any any (msg:"go.com"; appid:go.com; sid:1000977; rev:1)
alert tcp any any -> any any (msg:"onlive"; appid:onlive; sid:1000978; rev:1)
alert tcp any any -> any any (msg:"ad_advisor"; appid:ad_advisor; sid:1000979; rev:1)
alert tcp any any -> any any (msg:"ad_mob"; appid:ad_mob; sid:1000980; rev:1)
alert tcp any any -> any any (msg:"ad_marvel"; appid:ad_marvel; sid:1000981; rev:1)
alert tcp any any -> any any (msg:"naver"; appid:naver; sid:1000982; rev:1)
alert tcp any any -> any any (msg:"doubleclick"; appid:doubleclick; sid:1000983; rev:1)
alert tcp any any -> any any (msg:"ad_nexus"; appid:ad_nexus; sid:1000984; rev:1)
alert tcp any any -> any any (msg:"pubmatic"; appid:pubmatic; sid:1000985; rev:1)
alert tcp any any -> any any (msg:"iad"; appid:iad; sid:1000986; rev:1)
alert tcp any any -> any any (msg:"acrobat.com"; appid:acrobat.com; sid:1000987; rev:1)
alert tcp any any -> any any (msg:"box"; appid:box; sid:1000988; rev:1)
alert tcp any any -> any any (msg:"pandora_tv"; appid:pandora_tv; sid:1000989; rev:1)
alert tcp any any -> any any (msg:"cbs"; appid:cbs; sid:1000990; rev:1)
alert tcp any any -> any any (msg:"usa_today"; appid:usa_today; sid:1000991; rev:1)
alert tcp any any -> any any (msg:"microsoft_ads"; appid:microsoft_ads; sid:1000992; rev:1)
alert tcp any any -> any any (msg:"weather_undrgrd"; appid:weather_undrgrd; sid:1000993; rev:1)
alert tcp any any -> any any (msg:"clubbox"; appid:clubbox; sid:1000994; rev:1)
alert tcp any any -> any any (msg:"kiwoom"; appid:kiwoom; sid:1000995; rev:1)
alert tcp any any -> any any (msg:"dcinside"; appid:dcinside; sid:1000996; rev:1)
alert tcp any any -> any any (msg:"nate"; appid:nate; sid:1000997; rev:1)
alert tcp any any -> any any (msg:"fileguri"; appid:fileguri; sid:1000998; rev:1)
alert tcp any any -> any any (msg:"baidu"; appid:baidu; sid:1000999; rev:1)
alert tcp any any -> any any (msg:"babylon"; appid:babylon; sid:1001000; rev:1)
alert tcp any any -> any any (msg:"samsung"; appid:samsung; sid:1001001; rev:1)
alert tcp any any -> any any (msg:"tweetdeck"; appid:tweetdeck; sid:1001002; rev:1)
alert tcp any any -> any any (msg:"canvasrider"; appid:canvasrider; sid:1001003; rev:1)
alert tcp any any -> any any (msg:"zedo"; appid:zedo; sid:1001004; rev:1)
alert tcp any any -> any any (msg:"ehow"; appid:ehow; sid:1001005; rev:1)
alert tcp any any -> any any (msg:"espn"; appid:espn; sid:1001006; rev:1)
alert tcp any any -> any any (msg:"comcast"; appid:comcast; sid:1001007; rev:1)
alert tcp any any -> any any (msg:"foxnews"; appid:foxnews; sid:1001008; rev:1)
alert tcp any any -> any any (msg:"weather.com"; appid:weather.com; sid:1001009; rev:1)
alert tcp any any -> any any (msg:"weather.gov"; appid:weather.gov; sid:1001010; rev:1)
alert tcp any any -> any any (msg:"outbrain"; appid:outbrain; sid:1001011; rev:1)
alert tcp any any -> any any (msg:"huffington_post"; appid:huffington_post; sid:1001012; rev:1)
alert tcp any any -> any any (msg:"ask.com"; appid:ask.com; sid:1001013; rev:1)
alert tcp any any -> any any (msg:"optmd"; appid:optmd; sid:1001014; rev:1)
alert tcp any any -> any any (msg:"godaddy"; appid:godaddy; sid:1001015; rev:1)
alert tcp any any -> any any (msg:"etsy"; appid:etsy; sid:1001016; rev:1)
alert tcp any any -> any any (msg:"conduit"; appid:conduit; sid:1001017; rev:1)
alert tcp any any -> any any (msg:"bbc"; appid:bbc; sid:1001018; rev:1)
alert tcp any any -> any any (msg:"indeed"; appid:indeed; sid:1001019; rev:1)
alert tcp any any -> any any (msg:"pub_clear_house"; appid:pub_clear_house; sid:1001020; rev:1)
alert tcp any any -> any any (msg:"at&t"; appid:at&t; sid:1001021; rev:1)
alert tcp any any -> any any (msg:"aweber"; appid:aweber; sid:1001022; rev:1)
alert tcp any any -> any any (msg:"fox_sports"; appid:fox_sports; sid:1001023; rev:1)
alert tcp any any -> any any (msg:"searchnu"; appid:searchnu; sid:1001024; rev:1)
alert tcp any any -> any any (msg:"mlb"; appid:mlb; sid:1001025; rev:1)
alert tcp any any -> any any (msg:"roadrunner"; appid:roadrunner; sid:1001026; rev:1)
alert tcp any any -> any any (msg:"drudge_report"; appid:drudge_report; sid:1001027; rev:1)
alert tcp any any -> any any (msg:"verizon_wireless"; appid:verizon_wireless; sid:1001028; rev:1)
alert tcp any any -> any any (msg:"abc"; appid:abc; sid:1001029; rev:1)
alert tcp any any -> any any (msg:"wsj"; appid:wsj; sid:1001030; rev:1)
alert tcp any any -> any any (msg:"daily_mail"; appid:daily_mail; sid:1001031; rev:1)
alert tcp any any -> any any (msg:"aws"; appid:aws; sid:1001032; rev:1)
alert tcp any any -> any any (msg:"cloudfront"; appid:cloudfront; sid:1001033; rev:1)
alert tcp any any -> any any (msg:"sourcefire"; appid:sourcefire; sid:1001034; rev:1)
alert tcp any any -> any any (msg:"taobao"; appid:taobao; sid:1001035; rev:1)
alert tcp any any -> any any (msg:"planetarium"; appid:planetarium; sid:1001036; rev:1)
alert tcp any any -> any any (msg:"engadget"; appid:engadget; sid:1001037; rev:1)
alert tcp any any -> any any (msg:"flipboard"; appid:flipboard; sid:1001038; rev:1)
alert tcp any any -> any any (msg:"ted"; appid:ted; sid:1001039; rev:1)
alert tcp any any -> any any (msg:"kakaotalk"; appid:kakaotalk; sid:1001040; rev:1)
alert tcp any any -> any any (msg:"flurry_analytics"; appid:flurry_analytics; sid:1001041; rev:1)
alert tcp any any -> any any (msg:"apple_stocks"; appid:apple_stocks; sid:1001042; rev:1)
alert tcp any any -> any any (msg:"ubuntu_software_center"; appid:ubuntu_software_center; sid:1001043; rev:1)
alert tcp any any -> any any (msg:"ubuntu_update_manager"; appid:ubuntu_update_manager; sid:1001044; rev:1)
alert tcp any any -> any any (msg:"python-httplib"; appid:python-httplib; sid:1001045; rev:1)
alert tcp any any -> any any (msg:"eclipse_updates"; appid:eclipse_updates; sid:1001046; rev:1)
alert tcp any any -> any any (msg:"eclipse"; appid:eclipse; sid:1001047; rev:1)
alert tcp any any -> any any (msg:"eclipse_marketplace"; appid:eclipse_marketplace; sid:1001048; rev:1)
alert tcp any any -> any any (msg:"nasa"; appid:nasa; sid:1001049; rev:1)
alert tcp any any -> any any (msg:"nato"; appid:nato; sid:1001050; rev:1)
alert tcp any any -> any any (msg:"aol"; appid:aol; sid:1001051; rev:1)
alert tcp any any -> any any (msg:"noaa"; appid:noaa; sid:1001052; rev:1)
alert tcp any any -> any any (msg:"weatherbug"; appid:weatherbug; sid:1001053; rev:1)
alert tcp any any -> any any (msg:"fc2"; appid:fc2; sid:1001054; rev:1)
alert tcp any any -> any any (msg:"microsoft"; appid:microsoft; sid:1001055; rev:1)
alert tcp any any -> any any (msg:"google_adsense"; appid:google_adsense; sid:1001056; rev:1)
alert tcp any any -> any any (msg:"adnetwork.net"; appid:adnetwork.net; sid:1001057; rev:1)
alert tcp any any -> any any (msg:"localytics"; appid:localytics; sid:1001058; rev:1)
alert tcp any any -> any any (msg:"nokia_maps"; appid:nokia_maps; sid:1001059; rev:1)
alert tcp any any -> any any (msg:"symantecupdates"; appid:symantecupdates; sid:1001060; rev:1)
alert tcp any any -> any any (msg:"wolfram_alpha"; appid:wolfram_alpha; sid:1001061; rev:1)
alert tcp any any -> any any (msg:"libwww-perl"; appid:libwww-perl; sid:1001062; rev:1)
alert tcp any any -> any any (msg:"norton_av"; appid:norton_av; sid:1001063; rev:1)
alert tcp any any -> any any (msg:"fast_cgi"; appid:fast_cgi; sid:1001064; rev:1)
alert tcp any any -> any any (msg:"tpncp"; appid:tpncp; sid:1001065; rev:1)
alert tcp any any -> any any (msg:"smpp"; appid:smpp; sid:1001066; rev:1)
alert tcp any any -> any any (msg:"kismet"; appid:kismet; sid:1001067; rev:1)
alert tcp any any -> any any (msg:"sports_illus"; appid:sports_illus; sid:1001068; rev:1)
alert tcp any any -> any any (msg:"cpx_interactive"; appid:cpx_interactive; sid:1001069; rev:1)
alert tcp any any -> any any (msg:"verisign"; appid:verisign; sid:1001070; rev:1)
alert tcp any any -> any any (msg:"cbs_sports"; appid:cbs_sports; sid:1001071; rev:1)
alert tcp any any -> any any (msg:"chartbeat"; appid:chartbeat; sid:1001072; rev:1)
alert tcp any any -> any any (msg:"insightexpress"; appid:insightexpress; sid:1001073; rev:1)
alert tcp any any -> any any (msg:"zillow"; appid:zillow; sid:1001074; rev:1)
alert tcp any any -> any any (msg:"monster"; appid:monster; sid:1001075; rev:1)
alert tcp any any -> any any (msg:"mapquest"; appid:mapquest; sid:1001076; rev:1)
alert tcp any any -> any any (msg:"swagbucks"; appid:swagbucks; sid:1001077; rev:1)
alert tcp any any -> any any (msg:"verizon"; appid:verizon; sid:1001078; rev:1)
alert tcp any any -> any any (msg:"wikia"; appid:wikia; sid:1001079; rev:1)
alert tcp any any -> any any (msg:"tmz"; appid:tmz; sid:1001080; rev:1)
alert tcp any any -> any any (msg:"shopathome"; appid:shopathome; sid:1001081; rev:1)
alert tcp any any -> any any (msg:"asia_times_online"; appid:asia_times_online; sid:1001082; rev:1)
alert tcp any any -> any any (msg:"hootsuite"; appid:hootsuite; sid:1001083; rev:1)
alert tcp any any -> any any (msg:"coupons"; appid:coupons; sid:1001084; rev:1)
alert tcp any any -> any any (msg:"careerbuilder"; appid:careerbuilder; sid:1001085; rev:1)
alert tcp any any -> any any (msg:"commission_junction"; appid:commission_junction; sid:1001086; rev:1)
alert tcp any any -> any any (msg:"fiverr"; appid:fiverr; sid:1001087; rev:1)
alert tcp any any -> any any (msg:"backpage"; appid:backpage; sid:1001088; rev:1)
alert tcp any any -> any any (msg:"livingsocial"; appid:livingsocial; sid:1001089; rev:1)
alert tcp any any -> any any (msg:"allrecipes"; appid:allrecipes; sid:1001090; rev:1)
alert tcp any any -> any any (msg:"yellow_pages"; appid:yellow_pages; sid:1001091; rev:1)
alert tcp any any -> any any (msg:"bleacher_report"; appid:bleacher_report; sid:1001092; rev:1)
alert tcp any any -> any any (msg:"stack_overflow"; appid:stack_overflow; sid:1001093; rev:1)
alert tcp any any -> any any (msg:"usbank"; appid:usbank; sid:1001094; rev:1)
alert tcp any any -> any any (msg:"ancestry"; appid:ancestry; sid:1001095; rev:1)
alert tcp any any -> any any (msg:"webmd"; appid:webmd; sid:1001096; rev:1)
alert tcp any any -> any any (msg:"trulia"; appid:trulia; sid:1001097; rev:1)
alert tcp any any -> any any (msg:"slickdeals"; appid:slickdeals; sid:1001098; rev:1)
alert tcp any any -> any any (msg:"business_insider"; appid:business_insider; sid:1001099; rev:1)
alert tcp any any -> any any (msg:"people"; appid:people; sid:1001100; rev:1)
alert tcp any any -> any any (msg:"reuters"; appid:reuters; sid:1001101; rev:1)
alert tcp any any -> any any (msg:"buzzfeed"; appid:buzzfeed; sid:1001102; rev:1)
alert tcp any any -> any any (msg:"california.gov"; appid:california.gov; sid:1001103; rev:1)
alert tcp any any -> any any (msg:"southwest_airlines"; appid:southwest_airlines; sid:1001104; rev:1)
alert tcp any any -> any any (msg:"nih"; appid:nih; sid:1001105; rev:1)
alert tcp any any -> any any (msg:"whitepages"; appid:whitepages; sid:1001106; rev:1)
alert tcp any any -> any any (msg:"mgid"; appid:mgid; sid:1001107; rev:1)
alert tcp any any -> any any (msg:"earthlink"; appid:earthlink; sid:1001108; rev:1)
alert tcp any any -> any any (msg:"disney"; appid:disney; sid:1001109; rev:1)
alert tcp any any -> any any (msg:"politico"; appid:politico; sid:1001110; rev:1)
alert tcp any any -> any any (msg:"ny_daily_news"; appid:ny_daily_news; sid:1001111; rev:1)
alert tcp any any -> any any (msg:"examiner"; appid:examiner; sid:1001112; rev:1)
alert tcp any any -> any any (msg:"retailmenot"; appid:retailmenot; sid:1001113; rev:1)
alert tcp any any -> any any (msg:"addthis"; appid:addthis; sid:1001114; rev:1)
alert tcp any any -> any any (msg:"statcounter"; appid:statcounter; sid:1001115; rev:1)
alert tcp any any -> any any (msg:"okcupid"; appid:okcupid; sid:1001116; rev:1)
alert tcp any any -> any any (msg:"patch"; appid:patch; sid:1001117; rev:1)
alert tcp any any -> any any (msg:"legacy"; appid:legacy; sid:1001118; rev:1)
alert tcp any any -> any any (msg:"realtor"; appid:realtor; sid:1001119; rev:1)
alert tcp any any -> any any (msg:"intuit"; appid:intuit; sid:1001120; rev:1)
alert tcp any any -> any any (msg:"the_blaze"; appid:the_blaze; sid:1001121; rev:1)
alert tcp any any -> any any (msg:"hostgator"; appid:hostgator; sid:1001122; rev:1)
alert tcp any any -> any any (msg:"food_network"; appid:food_network; sid:1001123; rev:1)
alert tcp any any -> any any (msg:"clickbank"; appid:clickbank; sid:1001124; rev:1)
alert tcp any any -> any any (msg:"cox"; appid:cox; sid:1001125; rev:1)
alert tcp any any -> any any (msg:"mashable"; appid:mashable; sid:1001126; rev:1)
alert tcp any any -> any any (msg:"accuweather"; appid:accuweather; sid:1001127; rev:1)
alert tcp any any -> any any (msg:"sprint"; appid:sprint; sid:1001128; rev:1)
alert tcp any any -> any any (msg:"goodreads"; appid:goodreads; sid:1001129; rev:1)
alert tcp any any -> any any (msg:"livestrong"; appid:livestrong; sid:1001130; rev:1)
alert tcp any any -> any any (msg:"realclearpolitics"; appid:realclearpolitics; sid:1001131; rev:1)
alert tcp any any -> any any (msg:"manta"; appid:manta; sid:1001132; rev:1)
alert tcp any any -> any any (msg:"cnbc"; appid:cnbc; sid:1001133; rev:1)
alert tcp any any -> any any (msg:"inbox"; appid:inbox; sid:1001134; rev:1)
alert tcp any any -> any any (msg:"shutterfly"; appid:shutterfly; sid:1001135; rev:1)
alert tcp any any -> any any (msg:"neteller"; appid:neteller; sid:1001136; rev:1)
alert tcp any any -> any any (msg:"t_mobile"; appid:t_mobile; sid:1001137; rev:1)
alert tcp any any -> any any (msg:"walgreens"; appid:walgreens; sid:1001138; rev:1)
alert tcp any any -> any any (msg:"worldstarhiphop"; appid:worldstarhiphop; sid:1001139; rev:1)
alert tcp any any -> any any (msg:"npr"; appid:npr; sid:1001140; rev:1)
alert tcp any any -> any any (msg:"kayak"; appid:kayak; sid:1001141; rev:1)
alert tcp any any -> any any (msg:"toysrus"; appid:toysrus; sid:1001142; rev:1)
alert tcp any any -> any any (msg:"mail.ru"; appid:mail.ru; sid:1001143; rev:1)
alert tcp any any -> any any (msg:"sohu.com"; appid:sohu.com; sid:1001144; rev:1)
alert tcp any any -> any any (msg:"1n1_internet"; appid:1n1_internet; sid:1001145; rev:1)
alert tcp any any -> any any (msg:"ameba"; appid:ameba; sid:1001146; rev:1)
alert tcp any any -> any any (msg:"avaya"; appid:avaya; sid:1001147; rev:1)
alert tcp any any -> any any (msg:"snort"; appid:snort; sid:1001148; rev:1)
alert tcp any any -> any any (msg:"disqus"; appid:disqus; sid:1001149; rev:1)
alert tcp any any -> any any (msg:"infusionsoft"; appid:infusionsoft; sid:1001150; rev:1)
alert tcp any any -> any any (msg:"imrworldwide"; appid:imrworldwide; sid:1001151; rev:1)
alert tcp any any -> any any (msg:"alisoft"; appid:alisoft; sid:1001152; rev:1)
alert tcp any any -> any any (msg:"sales_liveagent"; appid:sales_liveagent; sid:1001153; rev:1)
alert tcp any any -> any any (msg:"fab.com"; appid:fab.com; sid:1001154; rev:1)
alert tcp any any -> any any (msg:"square"; appid:square; sid:1001155; rev:1)
alert tcp any any -> any any (msg:"java_update"; appid:java_update; sid:1001156; rev:1)
alert tcp any any -> any any (msg:"xlite_sip_client"; appid:xlite_sip_client; sid:1001157; rev:1)
alert tcp any any -> any any (msg:"x-pro_sip_client"; appid:x-pro_sip_client; sid:1001158; rev:1)
alert tcp any any -> any any (msg:"nero_sip_client"; appid:nero_sip_client; sid:1001159; rev:1)
alert tcp any any -> any any (msg:"clearsea_sip_client"; appid:clearsea_sip_client; sid:1001160; rev:1)
alert tcp any any -> any any (msg:"dooble"; appid:dooble; sid:1001161; rev:1)
alert tcp any any -> any any (msg:"lynx"; appid:lynx; sid:1001162; rev:1)
alert tcp any any -> any any (msg:"epiphany"; appid:epiphany; sid:1001163; rev:1)
alert tcp any any -> any any (msg:"chimera2"; appid:chimera2; sid:1001164; rev:1)
alert tcp any any -> any any (msg:"links"; appid:links; sid:1001165; rev:1)
alert tcp any any -> any any (msg:"midori"; appid:midori; sid:1001166; rev:1)
alert tcp any any -> any any (msg:"netsurf"; appid:netsurf; sid:1001167; rev:1)
alert tcp any any -> any any (msg:"rekonq"; appid:rekonq; sid:1001168; rev:1)
alert tcp any any -> any any (msg:"wapua"; appid:wapua; sid:1001169; rev:1)
alert tcp any any -> any any (msg:"comodo_dragon"; appid:comodo_dragon; sid:1001170; rev:1)
alert tcp any any -> any any (msg:"palemoon"; appid:palemoon; sid:1001171; rev:1)
alert tcp any any -> any any (msg:"wyzo"; appid:wyzo; sid:1001172; rev:1)
alert tcp any any -> any any (msg:"biodigital_human"; appid:biodigital_human; sid:1001173; rev:1)
alert tcp any any -> any any (msg:"apple_developer"; appid:apple_developer; sid:1001174; rev:1)
alert tcp any any -> any any (msg:"geewa"; appid:geewa; sid:1001175; rev:1)
alert tcp any any -> any any (msg:"gotomypc"; appid:gotomypc; sid:1001176; rev:1)
alert tcp any any -> any any (msg:"king.com"; appid:king.com; sid:1001177; rev:1)
alert tcp any any -> any any (msg:"usps"; appid:usps; sid:1001178; rev:1)
alert tcp any any -> any any (msg:"xcode"; appid:xcode; sid:1001179; rev:1)
alert tcp any any -> any any (msg:"siri"; appid:siri; sid:1001180; rev:1)
alert tcp any any -> any any (msg:"bria"; appid:bria; sid:1001181; rev:1)
alert tcp any any -> any any (msg:"sipxecs"; appid:sipxecs; sid:1001182; rev:1)
alert tcp any any -> any any (msg:"linphone"; appid:linphone; sid:1001183; rev:1)
alert tcp any any -> any any (msg:"opensips"; appid:opensips; sid:1001184; rev:1)
alert tcp any any -> any any (msg:"textme"; appid:textme; sid:1001185; rev:1)
alert tcp any any -> any any (msg:"freeswitch"; appid:freeswitch; sid:1001186; rev:1)
alert tcp any any -> any any (msg:"asterisk_pbx"; appid:asterisk_pbx; sid:1001187; rev:1)
alert tcp any any -> any any (msg:"textplus"; appid:textplus; sid:1001188; rev:1)
alert tcp any any -> any any (msg:"cisco_sip_gateway"; appid:cisco_sip_gateway; sid:1001189; rev:1)
alert tcp any any -> any any (msg:"nuance_voice_platform"; appid:nuance_voice_platform; sid:1001190; rev:1)
alert tcp any any -> any any (msg:"shutterstock"; appid:shutterstock; sid:1001191; rev:1)
alert tcp any any -> any any (msg:"aili"; appid:aili; sid:1001192; rev:1)
alert tcp any any -> any any (msg:"yandex"; appid:yandex; sid:1001193; rev:1)
alert tcp any any -> any any (msg:"adcash"; appid:adcash; sid:1001194; rev:1)
alert tcp any any -> any any (msg:"the_guardian"; appid:the_guardian; sid:1001195; rev:1)
alert tcp any any -> any any (msg:"yieldmanager"; appid:yieldmanager; sid:1001196; rev:1)
alert tcp any any -> any any (msg:"the_telegraph"; appid:the_telegraph; sid:1001197; rev:1)
alert tcp any any -> any any (msg:"livedoor"; appid:livedoor; sid:1001198; rev:1)
alert tcp any any -> any any (msg:"warriorforum"; appid:warriorforum; sid:1001199; rev:1)
alert tcp any any -> any any (msg:"indiatimes"; appid:indiatimes; sid:1001200; rev:1)
alert tcp any any -> any any (msg:"rediff.com"; appid:rediff.com; sid:1001201; rev:1)
alert tcp any any -> any any (msg:"spiegel_online"; appid:spiegel_online; sid:1001202; rev:1)
alert tcp any any -> any any (msg:"uol"; appid:uol; sid:1001203; rev:1)
alert tcp any any -> any any (msg:"jingdong"; appid:jingdong; sid:1001204; rev:1)
alert tcp any any -> any any (msg:"xinhuanet"; appid:xinhuanet; sid:1001205; rev:1)
alert tcp any any -> any any (msg:"showmypc"; appid:showmypc; sid:1001206; rev:1)
alert tcp any any -> any any (msg:"airtime"; appid:airtime; sid:1001207; rev:1)
alert tcp any any -> any any (msg:"csdn"; appid:csdn; sid:1001208; rev:1)
alert tcp any any -> any any (msg:"taringa"; appid:taringa; sid:1001209; rev:1)
alert tcp any any -> any any (msg:"aliexpress"; appid:aliexpress; sid:1001210; rev:1)
alert tcp any any -> any any (msg:"58_city"; appid:58_city; sid:1001211; rev:1)
alert tcp any any -> any any (msg:"letv"; appid:letv; sid:1001212; rev:1)
alert tcp any any -> any any (msg:"tianya"; appid:tianya; sid:1001213; rev:1)
alert tcp any any -> any any (msg:"rakuten"; appid:rakuten; sid:1001214; rev:1)
alert tcp any any -> any any (msg:"snapchat"; appid:snapchat; sid:1001215; rev:1)
alert tcp any any -> any any (msg:"500px"; appid:500px; sid:1001216; rev:1)
alert tcp any any -> any any (msg:"airbnb"; appid:airbnb; sid:1001217; rev:1)
alert tcp any any -> any any (msg:"urban_airship"; appid:urban_airship; sid:1001218; rev:1)
alert tcp any any -> any any (msg:"akamai"; appid:akamai; sid:1001219; rev:1)
alert tcp any any -> any any (msg:"loyalty_innovations"; appid:loyalty_innovations; sid:1001220; rev:1)
alert tcp any any -> any any (msg:"avaya_live"; appid:avaya_live; sid:1001221; rev:1)
alert tcp any any -> any any (msg:"dirbuster"; appid:dirbuster; sid:1001222; rev:1)
alert tcp any any -> any any (msg:"yy"; appid:yy; sid:1001223; rev:1)
alert tcp any any -> any any (msg:"dwolla"; appid:dwolla; sid:1001224; rev:1)
alert tcp any any -> any any (msg:"google_remote_desktop"; appid:google_remote_desktop; sid:1001225; rev:1)
alert tcp any any -> any any (msg:"line"; appid:line; sid:1001226; rev:1)
alert tcp any any -> any any (msg:"fancy"; appid:fancy; sid:1001227; rev:1)
alert tcp any any -> any any (msg:"github"; appid:github; sid:1001228; rev:1)
alert tcp any any -> any any (msg:"trend_micro"; appid:trend_micro; sid:1001229; rev:1)
alert tcp any any -> any any (msg:"ogg"; appid:ogg; sid:1001230; rev:1)
alert tcp any any -> any any (msg:"webm"; appid:webm; sid:1001231; rev:1)
alert tcp any any -> any any (msg:"qualysguard"; appid:qualysguard; sid:1001232; rev:1)
alert tcp any any -> any any (msg:"flexera_soft"; appid:flexera_soft; sid:1001233; rev:1)
alert tcp any any -> any any (msg:"osirix"; appid:osirix; sid:1001234; rev:1)
alert tcp any any -> any any (msg:"pacs"; appid:pacs; sid:1001235; rev:1)
alert tcp any any -> any any (msg:"dicom"; appid:dicom; sid:1001236; rev:1)
alert tcp any any -> any any (msg:"mac_app_store"; appid:mac_app_store; sid:1001237; rev:1)
alert tcp any any -> any any (msg:"airplay"; appid:airplay; sid:1001238; rev:1)
alert tcp any any -> any any (msg:"airtunes"; appid:airtunes; sid:1001239; rev:1)
alert tcp any any -> any any (msg:"apple_tv"; appid:apple_tv; sid:1001240; rev:1)
alert tcp any any -> any any (msg:"java"; appid:java; sid:1001241; rev:1)
alert tcp any any -> any any (msg:"soundrop"; appid:soundrop; sid:1001242; rev:1)
alert tcp any any -> any any (msg:"android_client"; appid:android_client; sid:1001243; rev:1)
alert tcp any any -> any any (msg:"vine"; appid:vine; sid:1001244; rev:1)
alert tcp any any -> any any (msg:"mylife"; appid:mylife; sid:1001245; rev:1)
alert tcp any any -> any any (msg:"ning"; appid:ning; sid:1001246; rev:1)
alert tcp any any -> any any (msg:"gravatar"; appid:gravatar; sid:1001247; rev:1)
alert tcp any any -> any any (msg:"kickstarter"; appid:kickstarter; sid:1001248; rev:1)
alert tcp any any -> any any (msg:"linux_mint"; appid:linux_mint; sid:1001249; rev:1)
alert tcp any any -> any any (msg:"washpost"; appid:washpost; sid:1001250; rev:1)
alert tcp any any -> any any (msg:"pandora_audio"; appid:pandora_audio; sid:1001251; rev:1)
alert tcp any any -> any any (msg:"elinks"; appid:elinks; sid:1001252; rev:1)
alert tcp any any -> any any (msg:"mdns"; appid:mdns; sid:1001253; rev:1)
alert tcp any any -> any any (msg:"vlc_media_play"; appid:vlc_media_play; sid:1001254; rev:1)
alert tcp any any -> any any (msg:"raptr"; appid:raptr; sid:1001255; rev:1)
alert tcp any any -> any any (msg:"upnp"; appid:upnp; sid:1001256; rev:1)
alert tcp any any -> any any (msg:"silk"; appid:silk; sid:1001257; rev:1)
alert tcp any any -> any any (msg:"ps3_web_browser"; appid:ps3_web_browser; sid:1001258; rev:1)
alert tcp any any -> any any (msg:"ps3_messenger"; appid:ps3_messenger; sid:1001259; rev:1)
alert tcp any any -> any any (msg:"ps_store"; appid:ps_store; sid:1001260; rev:1)
alert tcp any any -> any any (msg:"ps3_downloads"; appid:ps3_downloads; sid:1001261; rev:1)
alert tcp any any -> any any (msg:"ps3_updater"; appid:ps3_updater; sid:1001262; rev:1)
alert tcp any any -> any any (msg:"ps3_home_client"; appid:ps3_home_client; sid:1001263; rev:1)
alert tcp any any -> any any (msg:"nokia"; appid:nokia; sid:1001264; rev:1)
alert tcp any any -> any any (msg:"nokia_music"; appid:nokia_music; sid:1001265; rev:1)
alert tcp any any -> any any (msg:"nokia_store"; appid:nokia_store; sid:1001266; rev:1)
alert tcp any any -> any any (msg:"pbs"; appid:pbs; sid:1001267; rev:1)
alert tcp any any -> any any (msg:"truste"; appid:truste; sid:1001268; rev:1)
alert tcp any any -> any any (msg:"doubleverify"; appid:doubleverify; sid:1001269; rev:1)
alert tcp any any -> any any (msg:"wsdd"; appid:wsdd; sid:1001270; rev:1)
alert tcp any any -> any any (msg:"fdssdp"; appid:fdssdp; sid:1001271; rev:1)
alert tcp any any -> any any (msg:"exchange"; appid:exchange; sid:1001272; rev:1)
alert tcp any any -> any any (msg:"bizrate"; appid:bizrate; sid:1001273; rev:1)
alert tcp any any -> any any (msg:"people_walmart"; appid:people_walmart; sid:1001274; rev:1)
alert tcp any any -> any any (msg:"cute_overload"; appid:cute_overload; sid:1001275; rev:1)
alert tcp any any -> any any (msg:"cheezburger"; appid:cheezburger; sid:1001276; rev:1)
alert tcp any any -> any any (msg:"thechive"; appid:thechive; sid:1001277; rev:1)
alert tcp any any -> any any (msg:"truuconfessions"; appid:truuconfessions; sid:1001278; rev:1)
alert tcp any any -> any any (msg:"zergnet"; appid:zergnet; sid:1001279; rev:1)
alert tcp any any -> any any (msg:"wherecoolthingshappen"; appid:wherecoolthingshappen; sid:1001280; rev:1)
alert tcp any any -> any any (msg:"hr_block"; appid:hr_block; sid:1001281; rev:1)
alert tcp any any -> any any (msg:"const_contact"; appid:const_contact; sid:1001282; rev:1)
alert tcp any any -> any any (msg:"pivotal_tracker"; appid:pivotal_tracker; sid:1001283; rev:1)
alert tcp any any -> any any (msg:"tempo"; appid:tempo; sid:1001284; rev:1)
alert tcp any any -> any any (msg:"podio"; appid:podio; sid:1001285; rev:1)
alert tcp any any -> any any (msg:"liveperson"; appid:liveperson; sid:1001286; rev:1)
alert tcp any any -> any any (msg:"mention"; appid:mention; sid:1001287; rev:1)
alert tcp any any -> any any (msg:"feedly"; appid:feedly; sid:1001288; rev:1)
alert tcp any any -> any any (msg:"ipfix"; appid:ipfix; sid:1001289; rev:1)
alert tcp any any -> any any (msg:"mailbox"; appid:mailbox; sid:1001290; rev:1)
alert tcp any any -> any any (msg:"minecraft"; appid:minecraft; sid:1001291; rev:1)
alert tcp any any -> any any (msg:"rotten_tomatoes"; appid:rotten_tomatoes; sid:1001292; rev:1)
alert tcp any any -> any any (msg:"amazon_ad_sys"; appid:amazon_ad_sys; sid:1001293; rev:1)
alert tcp any any -> any any (msg:"mtv"; appid:mtv; sid:1001294; rev:1)
alert tcp any any -> any any (msg:"tightrope"; appid:tightrope; sid:1001295; rev:1)
alert tcp any any -> any any (msg:"glympse"; appid:glympse; sid:1001296; rev:1)
alert tcp any any -> any any (msg:"honeywell"; appid:honeywell; sid:1001297; rev:1)
alert tcp any any -> any any (msg:"tunein"; appid:tunein; sid:1001298; rev:1)
alert tcp any any -> any any (msg:"experion"; appid:experion; sid:1001299; rev:1)
alert tcp any any -> any any (msg:"backupgrid"; appid:backupgrid; sid:1001300; rev:1)
alert tcp any any -> any any (msg:"carbonite"; appid:carbonite; sid:1001301; rev:1)
alert tcp any any -> any any (msg:"ibackup"; appid:ibackup; sid:1001302; rev:1)
alert tcp any any -> any any (msg:"justcloud"; appid:justcloud; sid:1001303; rev:1)
alert tcp any any -> any any (msg:"mypcbackup"; appid:mypcbackup; sid:1001304; rev:1)
alert tcp any any -> any any (msg:"sos_online_backup"; appid:sos_online_backup; sid:1001305; rev:1)
alert tcp any any -> any any (msg:"sugarsync"; appid:sugarsync; sid:1001306; rev:1)
alert tcp any any -> any any (msg:"zipcloud"; appid:zipcloud; sid:1001307; rev:1)
alert tcp any any -> any any (msg:"pubnub"; appid:pubnub; sid:1001308; rev:1)
alert tcp any any -> any any (msg:"fios_tv"; appid:fios_tv; sid:1001309; rev:1)
alert tcp any any -> any any (msg:"vdio"; appid:vdio; sid:1001310; rev:1)
alert tcp any any -> any any (msg:"redbox"; appid:redbox; sid:1001311; rev:1)
alert tcp any any -> any any (msg:"google_fiber"; appid:google_fiber; sid:1001312; rev:1)
alert tcp any any -> any any (msg:"nba"; appid:nba; sid:1001313; rev:1)
alert tcp any any -> any any (msg:"nbc"; appid:nbc; sid:1001314; rev:1)
alert tcp any any -> any any (msg:"redorbit"; appid:redorbit; sid:1001315; rev:1)
alert tcp any any -> any any (msg:"space"; appid:space; sid:1001316; rev:1)
alert tcp any any -> any any (msg:"sockshare"; appid:sockshare; sid:1001317; rev:1)
alert tcp any any -> any any (msg:"bitgravity"; appid:bitgravity; sid:1001318; rev:1)
alert tcp any any -> any any (msg:"zmags"; appid:zmags; sid:1001319; rev:1)
alert tcp any any -> any any (msg:"gnome"; appid:gnome; sid:1001320; rev:1)
alert tcp any any -> any any (msg:"estsoft"; appid:estsoft; sid:1001321; rev:1)
alert tcp any any -> any any (msg:"cabal_online"; appid:cabal_online; sid:1001322; rev:1)
alert tcp any any -> any any (msg:"altools"; appid:altools; sid:1001323; rev:1)
alert tcp any any -> any any (msg:"slate_magazine"; appid:slate_magazine; sid:1001324; rev:1)
alert tcp any any -> any any (msg:"i_waste_so_much_time"; appid:i_waste_so_much_time; sid:1001325; rev:1)
alert tcp any any -> any any (msg:"biography"; appid:biography; sid:1001326; rev:1)
alert tcp any any -> any any (msg:"ubuntu"; appid:ubuntu; sid:1001327; rev:1)
alert tcp any any -> any any (msg:"comedy_central"; appid:comedy_central; sid:1001328; rev:1)
alert tcp any any -> any any (msg:"wired"; appid:wired; sid:1001329; rev:1)
alert tcp any any -> any any (msg:"e_online"; appid:e_online; sid:1001330; rev:1)
alert tcp any any -> any any (msg:"nhl.com"; appid:nhl.com; sid:1001331; rev:1)
alert tcp any any -> any any (msg:"presto"; appid:presto; sid:1001332; rev:1)
alert tcp any any -> any any (msg:"macports"; appid:macports; sid:1001333; rev:1)
alert tcp any any -> any any (msg:"philips_hue"; appid:philips_hue; sid:1001334; rev:1)
alert tcp any any -> any any (msg:"baiduspider"; appid:baiduspider; sid:1001335; rev:1)
alert tcp any any -> any any (msg:"k8_web_protect"; appid:k8_web_protect; sid:1001336; rev:1)
alert tcp any any -> any any (msg:"bing_bar"; appid:bing_bar; sid:1001337; rev:1)
alert tcp any any -> any any (msg:"toptenreviews"; appid:toptenreviews; sid:1001338; rev:1)
alert tcp any any -> any any (msg:"adweek"; appid:adweek; sid:1001339; rev:1)
alert tcp any any -> any any (msg:"the_week"; appid:the_week; sid:1001340; rev:1)
alert tcp any any -> any any (msg:"brightcove"; appid:brightcove; sid:1001341; rev:1)
alert tcp any any -> any any (msg:"newser"; appid:newser; sid:1001342; rev:1)
alert tcp any any -> any any (msg:"simpli.fi"; appid:simpli.fi; sid:1001343; rev:1)
alert tcp any any -> any any (msg:"google_code"; appid:google_code; sid:1001344; rev:1)
alert tcp any any -> any any (msg:"win_help_client"; appid:win_help_client; sid:1001345; rev:1)
alert tcp any any -> any any (msg:"roku"; appid:roku; sid:1001346; rev:1)
alert tcp any any -> any any (msg:"turn"; appid:turn; sid:1001347; rev:1)
alert tcp any any -> any any (msg:"splunk"; appid:splunk; sid:1001348; rev:1)
alert tcp any any -> any any (msg:"atlassian"; appid:atlassian; sid:1001349; rev:1)
alert tcp any any -> any any (msg:"prezi"; appid:prezi; sid:1001350; rev:1)
alert tcp any any -> any any (msg:"ifttt"; appid:ifttt; sid:1001351; rev:1)
alert tcp any any -> any any (msg:"opcua"; appid:opcua; sid:1001352; rev:1)
alert tcp any any -> any any (msg:"networker"; appid:networker; sid:1001353; rev:1)
alert tcp any any -> any any (msg:"network_setup"; appid:network_setup; sid:1001354; rev:1)
alert tcp any any -> any any (msg:"apple_iforgot"; appid:apple_iforgot; sid:1001355; rev:1)
alert tcp any any -> any any (msg:"jboss_remoting"; appid:jboss_remoting; sid:1001356; rev:1)
alert tcp any any -> any any (msg:"fink"; appid:fink; sid:1001357; rev:1)
alert tcp any any -> any any (msg:"photo_stream"; appid:photo_stream; sid:1001358; rev:1)
alert tcp any any -> any any (msg:"fox"; appid:fox; sid:1001359; rev:1)
alert tcp any any -> any any (msg:"washtimes"; appid:washtimes; sid:1001360; rev:1)
alert tcp any any -> any any (msg:"nextbus"; appid:nextbus; sid:1001361; rev:1)
alert tcp any any -> any any (msg:"openbsd"; appid:openbsd; sid:1001362; rev:1)
alert tcp any any -> any any (msg:"assoc_press"; appid:assoc_press; sid:1001363; rev:1)
alert tcp any any -> any any (msg:"wtop"; appid:wtop; sid:1001364; rev:1)
alert tcp any any -> any any (msg:"opensuse"; appid:opensuse; sid:1001365; rev:1)
alert tcp any any -> any any (msg:"turner_broadcst"; appid:turner_broadcst; sid:1001366; rev:1)
alert tcp any any -> any any (msg:"ncaa"; appid:ncaa; sid:1001367; rev:1)
alert tcp any any -> any any (msg:"dsw"; appid:dsw; sid:1001368; rev:1)
alert tcp any any -> any any (msg:"po.st"; appid:po.st; sid:1001369; rev:1)
alert tcp any any -> any any (msg:"cheapstuff"; appid:cheapstuff; sid:1001370; rev:1)
alert tcp any any -> any any (msg:"freestreams"; appid:freestreams; sid:1001371; rev:1)
alert tcp any any -> any any (msg:"clear_channel"; appid:clear_channel; sid:1001372; rev:1)
alert tcp any any -> any any (msg:"golf"; appid:golf; sid:1001373; rev:1)
alert tcp any any -> any any (msg:"boldchat"; appid:boldchat; sid:1001374; rev:1)
alert tcp any any -> any any (msg:"intermarkets"; appid:intermarkets; sid:1001375; rev:1)
alert tcp any any -> any any (msg:"woopra"; appid:woopra; sid:1001376; rev:1)
alert tcp any any -> any any (msg:"oclc"; appid:oclc; sid:1001377; rev:1)
alert tcp any any -> any any (msg:"chosun"; appid:chosun; sid:1001378; rev:1)
alert tcp any any -> any any (msg:"ooyala"; appid:ooyala; sid:1001379; rev:1)
alert tcp any any -> any any (msg:"itunes_u"; appid:itunes_u; sid:1001380; rev:1)
alert tcp any any -> any any (msg:"c-span"; appid:c-span; sid:1001381; rev:1)
alert tcp any any -> any any (msg:"game_front"; appid:game_front; sid:1001382; rev:1)
alert tcp any any -> any any (msg:"bitcoin"; appid:bitcoin; sid:1001383; rev:1)
alert tcp any any -> any any (msg:"litecoin"; appid:litecoin; sid:1001384; rev:1)
alert tcp any any -> any any (msg:"bitcoin_forum"; appid:bitcoin_forum; sid:1001385; rev:1)
alert tcp any any -> any any (msg:"lynda.com"; appid:lynda.com; sid:1001386; rev:1)
alert tcp any any -> any any (msg:"idxrad"; appid:idxrad; sid:1001387; rev:1)
alert tcp any any -> any any (msg:"pscribe"; appid:pscribe; sid:1001388; rev:1)
alert tcp any any -> any any (msg:"sunquest"; appid:sunquest; sid:1001389; rev:1)
alert tcp any any -> any any (msg:"medipac"; appid:medipac; sid:1001390; rev:1)
alert tcp any any -> any any (msg:"letterpress"; appid:letterpress; sid:1001391; rev:1)
alert tcp any any -> any any (msg:"game_center"; appid:game_center; sid:1001392; rev:1)
alert tcp any any -> any any (msg:"friendfinder"; appid:friendfinder; sid:1001393; rev:1)
alert tcp any any -> any any (msg:"audible"; appid:audible; sid:1001394; rev:1)
alert tcp any any -> any any (msg:"entert_weekly"; appid:entert_weekly; sid:1001395; rev:1)
alert tcp any any -> any any (msg:"epic"; appid:epic; sid:1001396; rev:1)
alert tcp any any -> any any (msg:"upmc"; appid:upmc; sid:1001397; rev:1)
alert tcp any any -> any any (msg:"speedtest"; appid:speedtest; sid:1001398; rev:1)
alert tcp any any -> any any (msg:"boxnet_upload"; appid:boxnet_upload; sid:1001399; rev:1)
alert tcp any any -> any any (msg:"flickr_upload"; appid:flickr_upload; sid:1001400; rev:1)
alert tcp any any -> any any (msg:"scribd_upload"; appid:scribd_upload; sid:1001401; rev:1)
alert tcp any any -> any any (msg:"youtube_upload"; appid:youtube_upload; sid:1001402; rev:1)
alert tcp any any -> any any (msg:"voxer"; appid:voxer; sid:1001403; rev:1)
alert tcp any any -> any any (msg:"microsoft_azure"; appid:microsoft_azure; sid:1001404; rev:1)
alert tcp any any -> any any (msg:"starbucks"; appid:starbucks; sid:1001405; rev:1)
alert tcp any any -> any any (msg:"itunes_music"; appid:itunes_music; sid:1001406; rev:1)
alert tcp any any -> any any (msg:"adblade"; appid:adblade; sid:1001407; rev:1)
alert tcp any any -> any any (msg:"blackberry_sites"; appid:blackberry_sites; sid:1001408; rev:1)
alert tcp any any -> any any (msg:"djpod"; appid:djpod; sid:1001409; rev:1)
alert tcp any any -> any any (msg:"ms_download"; appid:ms_download; sid:1001410; rev:1)
alert tcp any any -> any any (msg:"ms_autoupdate"; appid:ms_autoupdate; sid:1001411; rev:1)
alert tcp any any -> any any (msg:"myonlinearcade"; appid:myonlinearcade; sid:1001412; rev:1)
alert tcp any any -> any any (msg:"smugmug"; appid:smugmug; sid:1001413; rev:1)
alert tcp any any -> any any (msg:"usaa"; appid:usaa; sid:1001414; rev:1)
alert tcp any any -> any any (msg:"wimp.com"; appid:wimp.com; sid:1001415; rev:1)
alert tcp any any -> any any (msg:"zendesk"; appid:zendesk; sid:1001416; rev:1)
alert tcp any any -> any any (msg:"show_my_weather"; appid:show_my_weather; sid:1001417; rev:1)
alert tcp any any -> any any (msg:"mobitv"; appid:mobitv; sid:1001418; rev:1)
alert tcp any any -> any any (msg:"tv_guide"; appid:tv_guide; sid:1001419; rev:1)
alert tcp any any -> any any (msg:"ifunny"; appid:ifunny; sid:1001420; rev:1)
alert tcp any any -> any any (msg:"telenav"; appid:telenav; sid:1001421; rev:1)
alert tcp any any -> any any (msg:"vlingo"; appid:vlingo; sid:1001422; rev:1)
alert tcp any any -> any any (msg:"media_hub"; appid:media_hub; sid:1001423; rev:1)
alert tcp any any -> any any (msg:"cheapoair"; appid:cheapoair; sid:1001424; rev:1)
alert tcp any any -> any any (msg:"crunchyroll"; appid:crunchyroll; sid:1001425; rev:1)
alert tcp any any -> any any (msg:"eventbrite"; appid:eventbrite; sid:1001426; rev:1)
alert tcp any any -> any any (msg:"jpmorgan"; appid:jpmorgan; sid:1001427; rev:1)
alert tcp any any -> any any (msg:"gobank"; appid:gobank; sid:1001428; rev:1)
alert tcp any any -> any any (msg:"intel"; appid:intel; sid:1001429; rev:1)
alert tcp any any -> any any (msg:"amd"; appid:amd; sid:1001430; rev:1)
alert tcp any any -> any any (msg:"asus"; appid:asus; sid:1001431; rev:1)
alert tcp any any -> any any (msg:"acer"; appid:acer; sid:1001432; rev:1)
alert tcp any any -> any any (msg:"gateway"; appid:gateway; sid:1001433; rev:1)
alert tcp any any -> any any (msg:"toshiba"; appid:toshiba; sid:1001434; rev:1)
alert tcp any any -> any any (msg:"motorola"; appid:motorola; sid:1001435; rev:1)
alert tcp any any -> any any (msg:"nvidia"; appid:nvidia; sid:1001436; rev:1)
alert tcp any any -> any any (msg:"progressive"; appid:progressive; sid:1001437; rev:1)
alert tcp any any -> any any (msg:"state_farm"; appid:state_farm; sid:1001438; rev:1)
alert tcp any any -> any any (msg:"allstate"; appid:allstate; sid:1001439; rev:1)
alert tcp any any -> any any (msg:"geico"; appid:geico; sid:1001440; rev:1)
alert tcp any any -> any any (msg:"liberty_mutual"; appid:liberty_mutual; sid:1001441; rev:1)
alert tcp any any -> any any (msg:"ensighten"; appid:ensighten; sid:1001442; rev:1)
alert tcp any any -> any any (msg:"maxymiser"; appid:maxymiser; sid:1001443; rev:1)
alert tcp any any -> any any (msg:"jetsetz"; appid:jetsetz; sid:1001444; rev:1)
alert tcp any any -> any any (msg:"studentuniverse"; appid:studentuniverse; sid:1001445; rev:1)
alert tcp any any -> any any (msg:"perfectibe"; appid:perfectibe; sid:1001446; rev:1)
alert tcp any any -> any any (msg:"funny_or_die"; appid:funny_or_die; sid:1001447; rev:1)
alert tcp any any -> any any (msg:"collegehumor"; appid:collegehumor; sid:1001448; rev:1)
alert tcp any any -> any any (msg:"zombo"; appid:zombo; sid:1001449; rev:1)
alert tcp any any -> any any (msg:"viki"; appid:viki; sid:1001450; rev:1)
alert tcp any any -> any any (msg:"pnc_bank"; appid:pnc_bank; sid:1001451; rev:1)
alert tcp any any -> any any (msg:"red_hat"; appid:red_hat; sid:1001452; rev:1)
alert tcp any any -> any any (msg:"united_airlines"; appid:united_airlines; sid:1001453; rev:1)
alert tcp any any -> any any (msg:"textnow"; appid:textnow; sid:1001454; rev:1)
alert tcp any any -> any any (msg:"fedex"; appid:fedex; sid:1001455; rev:1)
alert tcp any any -> any any (msg:"american_airlines"; appid:american_airlines; sid:1001456; rev:1)
alert tcp any any -> any any (msg:"nuance"; appid:nuance; sid:1001457; rev:1)
alert tcp any any -> any any (msg:"al_jazeera"; appid:al_jazeera; sid:1001458; rev:1)
alert tcp any any -> any any (msg:"wimbledon"; appid:wimbledon; sid:1001459; rev:1)
alert tcp any any -> any any (msg:"mlive"; appid:mlive; sid:1001460; rev:1)
alert tcp any any -> any any (msg:"times_union"; appid:times_union; sid:1001461; rev:1)
alert tcp any any -> any any (msg:"berecruited"; appid:berecruited; sid:1001462; rev:1)
alert tcp any any -> any any (msg:"bitbucket"; appid:bitbucket; sid:1001463; rev:1)
alert tcp any any -> any any (msg:"detroit_press"; appid:detroit_press; sid:1001464; rev:1)
alert tcp any any -> any any (msg:"michigan_radio"; appid:michigan_radio; sid:1001465; rev:1)
alert tcp any any -> any any (msg:"de_telegraaf"; appid:de_telegraaf; sid:1001466; rev:1)
alert tcp any any -> any any (msg:"daily_beast"; appid:daily_beast; sid:1001467; rev:1)
alert tcp any any -> any any (msg:"free_dict"; appid:free_dict; sid:1001468; rev:1)
alert tcp any any -> any any (msg:"the_onion"; appid:the_onion; sid:1001469; rev:1)
alert tcp any any -> any any (msg:"weatherlink"; appid:weatherlink; sid:1001470; rev:1)
alert tcp any any -> any any (msg:"yahoo_calendar"; appid:yahoo_calendar; sid:1001471; rev:1)
alert tcp any any -> any any (msg:"gvfs"; appid:gvfs; sid:1001472; rev:1)
alert tcp any any -> any any (msg:"yammer"; appid:yammer; sid:1001473; rev:1)
alert tcp any any -> any any (msg:"ksfetch"; appid:ksfetch; sid:1001474; rev:1)
alert tcp any any -> any any (msg:"google_update"; appid:google_update; sid:1001475; rev:1)
alert tcp any any -> any any (msg:"googlebot_image_search"; appid:googlebot_image_search; sid:1001476; rev:1)
alert tcp any any -> any any (msg:"abonti"; appid:abonti; sid:1001477; rev:1)
alert tcp any any -> any any (msg:"zapier"; appid:zapier; sid:1001478; rev:1)
alert tcp any any -> any any (msg:"collider"; appid:collider; sid:1001479; rev:1)
alert tcp any any -> any any (msg:"wordreference"; appid:wordreference; sid:1001480; rev:1)
alert tcp any any -> any any (msg:"msoffice_word"; appid:msoffice_word; sid:1001481; rev:1)
alert tcp any any -> any any (msg:"msoffice_power"; appid:msoffice_power; sid:1001482; rev:1)
alert tcp any any -> any any (msg:"yandex_bot"; appid:yandex_bot; sid:1001483; rev:1)
alert tcp any any -> any any (msg:"mj12_bot"; appid:mj12_bot; sid:1001484; rev:1)
alert tcp any any -> any any (msg:"ms_cryptoapi"; appid:ms_cryptoapi; sid:1001485; rev:1)
alert tcp any any -> any any (msg:"frostwire"; appid:frostwire; sid:1001486; rev:1)
alert tcp any any -> any any (msg:"media_stream"; appid:media_stream; sid:1001487; rev:1)
alert tcp any any -> any any (msg:"ocspd"; appid:ocspd; sid:1001488; rev:1)
alert tcp any any -> any any (msg:"5by5_radio"; appid:5by5_radio; sid:1001489; rev:1)
alert tcp any any -> any any (msg:"acoon.de"; appid:acoon.de; sid:1001490; rev:1)
alert tcp any any -> any any (msg:"anipang"; appid:anipang; sid:1001491; rev:1)
alert tcp any any -> any any (msg:"apple_pubsub"; appid:apple_pubsub; sid:1001492; rev:1)
alert tcp any any -> any any (msg:"arcgis"; appid:arcgis; sid:1001493; rev:1)
alert tcp any any -> any any (msg:"boingo"; appid:boingo; sid:1001494; rev:1)
alert tcp any any -> any any (msg:"easou_spider"; appid:easou_spider; sid:1001495; rev:1)
alert tcp any any -> any any (msg:"feedburner"; appid:feedburner; sid:1001496; rev:1)
alert tcp any any -> any any (msg:"feedly_fetcher"; appid:feedly_fetcher; sid:1001497; rev:1)
alert tcp any any -> any any (msg:"genieo_filter"; appid:genieo_filter; sid:1001498; rev:1)
alert tcp any any -> any any (msg:"php"; appid:php; sid:1001499; rev:1)
alert tcp any any -> any any (msg:"apple_syndicate"; appid:apple_syndicate; sid:1001500; rev:1)
alert tcp any any -> any any (msg:"android_dnld"; appid:android_dnld; sid:1001501; rev:1)
alert tcp any any -> any any (msg:"sony"; appid:sony; sid:1001502; rev:1)
alert tcp any any -> any any (msg:"wetransfer"; appid:wetransfer; sid:1001503; rev:1)
alert tcp any any -> any any (msg:"speedrunslive"; appid:speedrunslive; sid:1001504; rev:1)
alert tcp any any -> any any (msg:"wdt"; appid:wdt; sid:1001505; rev:1)
alert tcp any any -> any any (msg:"twitterrific"; appid:twitterrific; sid:1001506; rev:1)
alert tcp any any -> any any (msg:"seattle_times"; appid:seattle_times; sid:1001507; rev:1)
alert tcp any any -> any any (msg:"oracle_sites"; appid:oracle_sites; sid:1001508; rev:1)
alert tcp any any -> any any (msg:"okta"; appid:okta; sid:1001509; rev:1)
alert tcp any any -> any any (msg:"nike"; appid:nike; sid:1001510; rev:1)
alert tcp any any -> any any (msg:"libsyn"; appid:libsyn; sid:1001511; rev:1)
alert tcp any any -> any any (msg:"investopedia"; appid:investopedia; sid:1001512; rev:1)
alert tcp any any -> any any (msg:"hollywood_reprt"; appid:hollywood_reprt; sid:1001513; rev:1)
alert tcp any any -> any any (msg:"johns_switcher"; appid:johns_switcher; sid:1001514; rev:1)
alert tcp any any -> any any (msg:"applecoremedia"; appid:applecoremedia; sid:1001515; rev:1)
alert tcp any any -> any any (msg:"ffffound"; appid:ffffound; sid:1001516; rev:1)
alert tcp any any -> any any (msg:"cnet_tv"; appid:cnet_tv; sid:1001517; rev:1)
alert tcp any any -> any any (msg:"fifth_third_bank"; appid:fifth_third_bank; sid:1001518; rev:1)
alert tcp any any -> any any (msg:"android_music"; appid:android_music; sid:1001519; rev:1)
alert tcp any any -> any any (msg:"adap.tv"; appid:adap.tv; sid:1001520; rev:1)
alert tcp any any -> any any (msg:"feedfetcher"; appid:feedfetcher; sid:1001521; rev:1)
alert tcp any any -> any any (msg:"gsa_crawler"; appid:gsa_crawler; sid:1001522; rev:1)
alert tcp any any -> any any (msg:"kraken"; appid:kraken; sid:1001523; rev:1)
alert tcp any any -> any any (msg:"magpie"; appid:magpie; sid:1001524; rev:1)
alert tcp any any -> any any (msg:"sogou_spider"; appid:sogou_spider; sid:1001525; rev:1)
alert tcp any any -> any any (msg:"voilabot"; appid:voilabot; sid:1001526; rev:1)
alert tcp any any -> any any (msg:"drugs"; appid:drugs; sid:1001527; rev:1)
alert tcp any any -> any any (msg:"campfire"; appid:campfire; sid:1001528; rev:1)
alert tcp any any -> any any (msg:"audiodocument"; appid:audiodocument; sid:1001529; rev:1)
alert tcp any any -> any any (msg:"quick_look"; appid:quick_look; sid:1001530; rev:1)
alert tcp any any -> any any (msg:"nvidia_update"; appid:nvidia_update; sid:1001531; rev:1)
alert tcp any any -> any any (msg:"connexion_clnt"; appid:connexion_clnt; sid:1001532; rev:1)
alert tcp any any -> any any (msg:"ps3_comm_agent"; appid:ps3_comm_agent; sid:1001533; rev:1)
alert tcp any any -> any any (msg:"ps3_actv_agent"; appid:ps3_actv_agent; sid:1001534; rev:1)
alert tcp any any -> any any (msg:"psp_comm_agent"; appid:psp_comm_agent; sid:1001535; rev:1)
alert tcp any any -> any any (msg:"msoffice_exist"; appid:msoffice_exist; sid:1001536; rev:1)
alert tcp any any -> any any (msg:"msoffice_proto"; appid:msoffice_proto; sid:1001537; rev:1)
alert tcp any any -> any any (msg:"rainmeter"; appid:rainmeter; sid:1001538; rev:1)
alert tcp any any -> any any (msg:"recaptcha"; appid:recaptcha; sid:1001539; rev:1)
alert tcp any any -> any any (msg:"simple-get"; appid:simple-get; sid:1001540; rev:1)
alert tcp any any -> any any (msg:"wood_tv8"; appid:wood_tv8; sid:1001541; rev:1)
alert tcp any any -> any any (msg:"malware_defense_system"; appid:malware_defense_system; sid:1001542; rev:1)
alert tcp any any -> any any (msg:"msoffice_excel"; appid:msoffice_excel; sid:1001543; rev:1)
alert tcp any any -> any any (msg:"ms_ncsi"; appid:ms_ncsi; sid:1001544; rev:1)
alert tcp any any -> any any (msg:"ms_wns"; appid:ms_wns; sid:1001545; rev:1)
alert tcp any any -> any any (msg:"moodlebot"; appid:moodlebot; sid:1001546; rev:1)
alert tcp any any -> any any (msg:"win_phone_browz"; appid:win_phone_browz; sid:1001547; rev:1)
alert tcp any any -> any any (msg:"xprotectupdater"; appid:xprotectupdater; sid:1001548; rev:1)
alert tcp any any -> any any (msg:"xenu_link"; appid:xenu_link; sid:1001549; rev:1)
alert tcp any any -> any any (msg:"utorrent"; appid:utorrent; sid:1001550; rev:1)
alert tcp any any -> any any (msg:"urlappendbot"; appid:urlappendbot; sid:1001551; rev:1)
alert tcp any any -> any any (msg:"tiny_tiny_rss"; appid:tiny_tiny_rss; sid:1001552; rev:1)
alert tcp any any -> any any (msg:"tinder"; appid:tinder; sid:1001553; rev:1)
alert tcp any any -> any any (msg:"sage"; appid:sage; sid:1001554; rev:1)
alert tcp any any -> any any (msg:"radian6_commentreader"; appid:radian6_commentreader; sid:1001555; rev:1)
alert tcp any any -> any any (msg:"powermarks"; appid:powermarks; sid:1001556; rev:1)
alert tcp any any -> any any (msg:"pdf_expert"; appid:pdf_expert; sid:1001557; rev:1)
alert tcp any any -> any any (msg:"google_pagespeed"; appid:google_pagespeed; sid:1001558; rev:1)
alert tcp any any -> any any (msg:"owlinbot"; appid:owlinbot; sid:1001559; rev:1)
alert tcp any any -> any any (msg:"yeti_bot"; appid:yeti_bot; sid:1001560; rev:1)
alert tcp any any -> any any (msg:"tpkt"; appid:tpkt; sid:1001561; rev:1)
alert tcp any any -> any any (msg:"isomms"; appid:isomms; sid:1001562; rev:1)
alert tcp any any -> any any (msg:"pubsubhubbub"; appid:pubsubhubbub; sid:1001563; rev:1)
alert tcp any any -> any any (msg:"ndgsa-crawler"; appid:ndgsa-crawler; sid:1001564; rev:1)
alert tcp any any -> any any (msg:"msoffice_access"; appid:msoffice_access; sid:1001565; rev:1)
alert tcp any any -> any any (msg:"dr_watson"; appid:dr_watson; sid:1001566; rev:1)
alert tcp any any -> any any (msg:"netsight"; appid:netsight; sid:1001567; rev:1)
alert tcp any any -> any any (msg:"ovi_browser"; appid:ovi_browser; sid:1001568; rev:1)
alert tcp any any -> any any (msg:"penultimate"; appid:penultimate; sid:1001569; rev:1)
alert tcp any any -> any any (msg:"ossproxy"; appid:ossproxy; sid:1001570; rev:1)
alert tcp any any -> any any (msg:"netnewswire"; appid:netnewswire; sid:1001571; rev:1)
alert tcp any any -> any any (msg:"050plus"; appid:050plus; sid:1001572; rev:1)
alert tcp any any -> any any (msg:"maxdb"; appid:maxdb; sid:1001573; rev:1)
alert tcp any any -> any any (msg:"urlgrabber"; appid:urlgrabber; sid:1001574; rev:1)
alert tcp any any -> any any (msg:"apache_nutch"; appid:apache_nutch; sid:1001575; rev:1)
alert tcp any any -> any any (msg:"mobileasset"; appid:mobileasset; sid:1001576; rev:1)
alert tcp any any -> any any (msg:"mcstats"; appid:mcstats; sid:1001577; rev:1)
alert tcp any any -> any any (msg:"mapmyfitness"; appid:mapmyfitness; sid:1001578; rev:1)
alert tcp any any -> any any (msg:"jikespider"; appid:jikespider; sid:1001579; rev:1)
alert tcp any any -> any any (msg:"mediabot"; appid:mediabot; sid:1001580; rev:1)
alert tcp any any -> any any (msg:"feed43"; appid:feed43; sid:1001581; rev:1)
alert tcp any any -> any any (msg:"dragon_dictate"; appid:dragon_dictate; sid:1001582; rev:1)
alert tcp any any -> any any (msg:"coc_coc_bot"; appid:coc_coc_bot; sid:1001583; rev:1)
alert tcp any any -> any any (msg:"2345.com"; appid:2345.com; sid:1001584; rev:1)
alert tcp any any -> any any (msg:"forbes"; appid:forbes; sid:1001585; rev:1)
alert tcp any any -> any any (msg:"freee_tv"; appid:freee_tv; sid:1001586; rev:1)
alert tcp any any -> any any (msg:"ikea.com"; appid:ikea.com; sid:1001587; rev:1)
alert tcp any any -> any any (msg:"pchome"; appid:pchome; sid:1001588; rev:1)
alert tcp any any -> any any (msg:"techinline"; appid:techinline; sid:1001589; rev:1)
alert tcp any any -> any any (msg:"wikidot"; appid:wikidot; sid:1001590; rev:1)
alert tcp any any -> any any (msg:"quote.com"; appid:quote.com; sid:1001591; rev:1)
alert tcp any any -> any any (msg:"cbs_interactive"; appid:cbs_interactive; sid:1001592; rev:1)
alert tcp any any -> any any (msg:"hupu"; appid:hupu; sid:1001593; rev:1)
alert tcp any any -> any any (msg:"foursquare"; appid:foursquare; sid:1001594; rev:1)
alert tcp any any -> any any (msg:"the_internet_archive"; appid:the_internet_archive; sid:1001595; rev:1)
alert tcp any any -> any any (msg:"doof"; appid:doof; sid:1001596; rev:1)
alert tcp any any -> any any (msg:"adenin"; appid:adenin; sid:1001597; rev:1)
alert tcp any any -> any any (msg:"groupon"; appid:groupon; sid:1001598; rev:1)
alert tcp any any -> any any (msg:"match.com"; appid:match.com; sid:1001599; rev:1)
alert tcp any any -> any any (msg:"meetup"; appid:meetup; sid:1001600; rev:1)
alert tcp any any -> any any (msg:"mywebsearch"; appid:mywebsearch; sid:1001601; rev:1)
alert tcp any any -> any any (msg:"uploading.com"; appid:uploading.com; sid:1001602; rev:1)
alert tcp any any -> any any (msg:"viber"; appid:viber; sid:1001603; rev:1)
alert tcp any any -> any any (msg:"adnstream"; appid:adnstream; sid:1001604; rev:1)
alert tcp any any -> any any (msg:"china.com"; appid:china.com; sid:1001605; rev:1)
alert tcp any any -> any any (msg:"in.com"; appid:in.com; sid:1001606; rev:1)
alert tcp any any -> any any (msg:"it168"; appid:it168; sid:1001607; rev:1)
alert tcp any any -> any any (msg:"nfl.com"; appid:nfl.com; sid:1001608; rev:1)
alert tcp any any -> any any (msg:"wetpaint entertainment"; appid:wetpaint entertainment; sid:1001609; rev:1)
alert tcp any any -> any any (msg:"tango"; appid:tango; sid:1001610; rev:1)
alert tcp any any -> any any (msg:"pptv"; appid:pptv; sid:1001611; rev:1)
alert tcp any any -> any any (msg:"apple_maps"; appid:apple_maps; sid:1001612; rev:1)
alert tcp any any -> any any (msg:"sendspace"; appid:sendspace; sid:1001613; rev:1)
alert tcp any any -> any any (msg:"sogou"; appid:sogou; sid:1001614; rev:1)
alert tcp any any -> any any (msg:"17173.com"; appid:17173.com; sid:1001615; rev:1)
alert tcp any any -> any any (msg:"alibaba"; appid:alibaba; sid:1001616; rev:1)
alert tcp any any -> any any (msg:"tmall"; appid:tmall; sid:1001617; rev:1)
alert tcp any any -> any any (msg:"etao"; appid:etao; sid:1001618; rev:1)
alert tcp any any -> any any (msg:"aliyun"; appid:aliyun; sid:1001619; rev:1)
alert tcp any any -> any any (msg:"naverisk"; appid:naverisk; sid:1001620; rev:1)
alert tcp any any -> any any (msg:"funshion"; appid:funshion; sid:1001621; rev:1)
alert tcp any any -> any any (msg:"tokbox"; appid:tokbox; sid:1001622; rev:1)
alert tcp any any -> any any (msg:"google_ads"; appid:google_ads; sid:1001623; rev:1)
alert tcp any any -> any any (msg:"richrelevance"; appid:richrelevance; sid:1001624; rev:1)
alert tcp any any -> any any (msg:"quantcast"; appid:quantcast; sid:1001625; rev:1)
alert tcp any any -> any any (msg:"scorecard_research"; appid:scorecard_research; sid:1001626; rev:1)
alert tcp any any -> any any (msg:"spc_media"; appid:spc_media; sid:1001627; rev:1)
alert tcp any any -> any any (msg:"epsilon"; appid:epsilon; sid:1001628; rev:1)
alert tcp any any -> any any (msg:"appnexus"; appid:appnexus; sid:1001629; rev:1)
alert tcp any any -> any any (msg:"adconion_media_group"; appid:adconion_media_group; sid:1001630; rev:1)
alert tcp any any -> any any (msg:"openx"; appid:openx; sid:1001631; rev:1)
alert tcp any any -> any any (msg:"mediamath"; appid:mediamath; sid:1001632; rev:1)
alert tcp any any -> any any (msg:"rubicon_project"; appid:rubicon_project; sid:1001633; rev:1)
alert tcp any any -> any any (msg:"33across"; appid:33across; sid:1001634; rev:1)
alert tcp any any -> any any (msg:"akamai_netsess"; appid:akamai_netsess; sid:1001635; rev:1)
alert tcp any any -> any any (msg:"ahrefsbot"; appid:ahrefsbot; sid:1001636; rev:1)
alert tcp any any -> any any (msg:"addthis_bot"; appid:addthis_bot; sid:1001637; rev:1)
alert tcp any any -> any any (msg:"imtransferagent"; appid:imtransferagent; sid:1001638; rev:1)
alert tcp any any -> any any (msg:"the_atlantic"; appid:the_atlantic; sid:1001639; rev:1)
alert tcp any any -> any any (msg:"svpply"; appid:svpply; sid:1001640; rev:1)
alert tcp any any -> any any (msg:"southern_living"; appid:southern_living; sid:1001641; rev:1)
alert tcp any any -> any any (msg:"buffer"; appid:buffer; sid:1001642; rev:1)
alert tcp any any -> any any (msg:"coupa"; appid:coupa; sid:1001643; rev:1)
alert tcp any any -> any any (msg:"escapist"; appid:escapist; sid:1001644; rev:1)
alert tcp any any -> any any (msg:"pocket"; appid:pocket; sid:1001645; rev:1)
alert tcp any any -> any any (msg:"grantland"; appid:grantland; sid:1001646; rev:1)
alert tcp any any -> any any (msg:"the_independent"; appid:the_independent; sid:1001647; rev:1)
alert tcp any any -> any any (msg:"instapaper"; appid:instapaper; sid:1001648; rev:1)
alert tcp any any -> any any (msg:"kbs"; appid:kbs; sid:1001649; rev:1)
alert tcp any any -> any any (msg:"pinboard"; appid:pinboard; sid:1001650; rev:1)
alert tcp any any -> any any (msg:"pushover"; appid:pushover; sid:1001651; rev:1)
alert tcp any any -> any any (msg:"dots"; appid:dots; sid:1001652; rev:1)
alert tcp any any -> any any (msg:"improve_digital"; appid:improve_digital; sid:1001653; rev:1)
alert tcp any any -> any any (msg:"bluekai"; appid:bluekai; sid:1001654; rev:1)
alert tcp any any -> any any (msg:"admeld"; appid:admeld; sid:1001655; rev:1)
alert tcp any any -> any any (msg:"iperceptions"; appid:iperceptions; sid:1001656; rev:1)
alert tcp any any -> any any (msg:"atlas_advertiser_suite"; appid:atlas_advertiser_suite; sid:1001657; rev:1)
alert tcp any any -> any any (msg:"brsrvr"; appid:brsrvr; sid:1001658; rev:1)
alert tcp any any -> any any (msg:"compete"; appid:compete; sid:1001659; rev:1)
alert tcp any any -> any any (msg:"brcdn"; appid:brcdn; sid:1001660; rev:1)
alert tcp any any -> any any (msg:"silverpop"; appid:silverpop; sid:1001661; rev:1)
alert tcp any any -> any any (msg:"infonline"; appid:infonline; sid:1001662; rev:1)
alert tcp any any -> any any (msg:"comscore"; appid:comscore; sid:1001663; rev:1)
alert tcp any any -> any any (msg:"komli_media"; appid:komli_media; sid:1001664; rev:1)
alert tcp any any -> any any (msg:"sizmek_ad_suite"; appid:sizmek_ad_suite; sid:1001665; rev:1)
alert tcp any any -> any any (msg:"lotame"; appid:lotame; sid:1001666; rev:1)
alert tcp any any -> any any (msg:"krux"; appid:krux; sid:1001667; rev:1)
alert tcp any any -> any any (msg:"audiencescience"; appid:audiencescience; sid:1001668; rev:1)
alert tcp any any -> any any (msg:"nielsen"; appid:nielsen; sid:1001669; rev:1)
alert tcp any any -> any any (msg:"google_play"; appid:google_play; sid:1001670; rev:1)
alert tcp any any -> any any (msg:"android.com"; appid:android.com; sid:1001671; rev:1)
alert tcp any any -> any any (msg:"pdbox"; appid:pdbox; sid:1001672; rev:1)
alert tcp any any -> any any (msg:"skype_for_business"; appid:skype_for_business; sid:1001673; rev:1)
alert tcp any any -> any any (msg:"east_money"; appid:east_money; sid:1001674; rev:1)
alert tcp any any -> any any (msg:"blokus"; appid:blokus; sid:1001675; rev:1)
alert tcp any any -> any any (msg:"freelancer"; appid:freelancer; sid:1001676; rev:1)
alert tcp any any -> any any (msg:"goal"; appid:goal; sid:1001677; rev:1)
alert tcp any any -> any any (msg:"hubpages"; appid:hubpages; sid:1001678; rev:1)
alert tcp any any -> any any (msg:"marca"; appid:marca; sid:1001679; rev:1)
alert tcp any any -> any any (msg:"telly"; appid:telly; sid:1001680; rev:1)
alert tcp any any -> any any (msg:"chinauma"; appid:chinauma; sid:1001681; rev:1)
alert tcp any any -> any any (msg:"adsage"; appid:adsage; sid:1001682; rev:1)
alert tcp any any -> any any (msg:"247_inc."; appid:247_inc.; sid:1001683; rev:1)
alert tcp any any -> any any (msg:"sli_systems"; appid:sli_systems; sid:1001684; rev:1)
alert tcp any any -> any any (msg:"owneriq"; appid:owneriq; sid:1001685; rev:1)
alert tcp any any -> any any (msg:"monetate"; appid:monetate; sid:1001686; rev:1)
alert tcp any any -> any any (msg:"adready"; appid:adready; sid:1001687; rev:1)
alert tcp any any -> any any (msg:"the_trade_desk"; appid:the_trade_desk; sid:1001688; rev:1)
alert tcp any any -> any any (msg:"adgear"; appid:adgear; sid:1001689; rev:1)
alert tcp any any -> any any (msg:"mediav"; appid:mediav; sid:1001690; rev:1)
alert tcp any any -> any any (msg:"clicktale"; appid:clicktale; sid:1001691; rev:1)
alert tcp any any -> any any (msg:"adtech"; appid:adtech; sid:1001692; rev:1)
alert tcp any any -> any any (msg:"amobee"; appid:amobee; sid:1001693; rev:1)
alert tcp any any -> any any (msg:"leadbolt"; appid:leadbolt; sid:1001694; rev:1)
alert tcp any any -> any any (msg:"mobile_theory"; appid:mobile_theory; sid:1001695; rev:1)
alert tcp any any -> any any (msg:"drawbridge"; appid:drawbridge; sid:1001696; rev:1)
alert tcp any any -> any any (msg:"evidon"; appid:evidon; sid:1001697; rev:1)
alert tcp any any -> any any (msg:"brilig"; appid:brilig; sid:1001698; rev:1)
alert tcp any any -> any any (msg:"casale"; appid:casale; sid:1001699; rev:1)
alert tcp any any -> any any (msg:"chango"; appid:chango; sid:1001700; rev:1)
alert tcp any any -> any any (msg:"criteo"; appid:criteo; sid:1001701; rev:1)
alert tcp any any -> any any (msg:"narratiive"; appid:narratiive; sid:1001702; rev:1)
alert tcp any any -> any any (msg:"exelate"; appid:exelate; sid:1001703; rev:1)
alert tcp any any -> any any (msg:"exponential_interactive"; appid:exponential_interactive; sid:1001704; rev:1)
alert tcp any any -> any any (msg:"vibrant"; appid:vibrant; sid:1001705; rev:1)
alert tcp any any -> any any (msg:"luminate"; appid:luminate; sid:1001706; rev:1)
alert tcp any any -> any any (msg:"media6degrees"; appid:media6degrees; sid:1001707; rev:1)
alert tcp any any -> any any (msg:"motrixi"; appid:motrixi; sid:1001708; rev:1)
alert tcp any any -> any any (msg:"eyereturn"; appid:eyereturn; sid:1001709; rev:1)
alert tcp any any -> any any (msg:"inskin_media"; appid:inskin_media; sid:1001710; rev:1)
alert tcp any any -> any any (msg:"connextra"; appid:connextra; sid:1001711; rev:1)
alert tcp any any -> any any (msg:"optimizely"; appid:optimizely; sid:1001712; rev:1)
alert tcp any any -> any any (msg:"integral_ad_science"; appid:integral_ad_science; sid:1001713; rev:1)
alert tcp any any -> any any (msg:"proclivity"; appid:proclivity; sid:1001714; rev:1)
alert tcp any any -> any any (msg:"tubemogul"; appid:tubemogul; sid:1001715; rev:1)
alert tcp any any -> any any (msg:"cloudflare"; appid:cloudflare; sid:1001716; rev:1)
alert tcp any any -> any any (msg:"tlvmedia"; appid:tlvmedia; sid:1001717; rev:1)
alert tcp any any -> any any (msg:"neustar_information_services"; appid:neustar_information_services; sid:1001718; rev:1)
alert tcp any any -> any any (msg:"adxpose"; appid:adxpose; sid:1001719; rev:1)
alert tcp any any -> any any (msg:"eq_ads"; appid:eq_ads; sid:1001720; rev:1)
alert tcp any any -> any any (msg:"towerdata"; appid:towerdata; sid:1001721; rev:1)
alert tcp any any -> any any (msg:"xaxis"; appid:xaxis; sid:1001722; rev:1)
alert tcp any any -> any any (msg:"datalogicx"; appid:datalogicx; sid:1001723; rev:1)
alert tcp any any -> any any (msg:"ybrant_digital"; appid:ybrant_digital; sid:1001724; rev:1)
alert tcp any any -> any any (msg:"aggregate_knowledge"; appid:aggregate_knowledge; sid:1001725; rev:1)
alert tcp any any -> any any (msg:"spotxchange"; appid:spotxchange; sid:1001726; rev:1)
alert tcp any any -> any any (msg:"netseer"; appid:netseer; sid:1001727; rev:1)
alert tcp any any -> any any (msg:"resonate_networks"; appid:resonate_networks; sid:1001728; rev:1)
alert tcp any any -> any any (msg:"engage_bdr"; appid:engage_bdr; sid:1001729; rev:1)
alert tcp any any -> any any (msg:"connexity"; appid:connexity; sid:1001730; rev:1)
alert tcp any any -> any any (msg:"bizo"; appid:bizo; sid:1001731; rev:1)
alert tcp any any -> any any (msg:"verizon_media"; appid:verizon_media; sid:1001732; rev:1)
alert tcp any any -> any any (msg:"federated_media"; appid:federated_media; sid:1001733; rev:1)
alert tcp any any -> any any (msg:"six_apart"; appid:six_apart; sid:1001734; rev:1)
alert tcp any any -> any any (msg:"maxpoint_interactive"; appid:maxpoint_interactive; sid:1001735; rev:1)
alert tcp any any -> any any (msg:"rocket_fuel"; appid:rocket_fuel; sid:1001736; rev:1)
alert tcp any any -> any any (msg:"rhythmone"; appid:rhythmone; sid:1001737; rev:1)
alert tcp any any -> any any (msg:"contnet"; appid:contnet; sid:1001738; rev:1)
alert tcp any any -> any any (msg:"smart_adserver"; appid:smart_adserver; sid:1001739; rev:1)
alert tcp any any -> any any (msg:"admeta"; appid:admeta; sid:1001740; rev:1)
alert tcp any any -> any any (msg:"adify"; appid:adify; sid:1001741; rev:1)
alert tcp any any -> any any (msg:"contextweb"; appid:contextweb; sid:1001742; rev:1)
alert tcp any any -> any any (msg:"cxense"; appid:cxense; sid:1001743; rev:1)
alert tcp any any -> any any (msg:"caraytech"; appid:caraytech; sid:1001744; rev:1)
alert tcp any any -> any any (msg:"freewheel"; appid:freewheel; sid:1001745; rev:1)
alert tcp any any -> any any (msg:"bv!_media"; appid:bv!_media; sid:1001746; rev:1)
alert tcp any any -> any any (msg:"adtegrity"; appid:adtegrity; sid:1001747; rev:1)
alert tcp any any -> any any (msg:"aol_ads"; appid:aol_ads; sid:1001748; rev:1)
alert tcp any any -> any any (msg:"compuware"; appid:compuware; sid:1001749; rev:1)
alert tcp any any -> any any (msg:"aptean"; appid:aptean; sid:1001750; rev:1)
alert tcp any any -> any any (msg:"polldaddy"; appid:polldaddy; sid:1001751; rev:1)
alert tcp any any -> any any (msg:"undertone"; appid:undertone; sid:1001752; rev:1)
alert tcp any any -> any any (msg:"voicefive"; appid:voicefive; sid:1001753; rev:1)
alert tcp any any -> any any (msg:"clickbooth"; appid:clickbooth; sid:1001754; rev:1)
alert tcp any any -> any any (msg:"webtrends"; appid:webtrends; sid:1001755; rev:1)
alert tcp any any -> any any (msg:"telecom_express"; appid:telecom_express; sid:1001756; rev:1)
alert tcp any any -> any any (msg:"skimlinks"; appid:skimlinks; sid:1001757; rev:1)
alert tcp any any -> any any (msg:"crowd_science"; appid:crowd_science; sid:1001758; rev:1)
alert tcp any any -> any any (msg:"mixpanel"; appid:mixpanel; sid:1001759; rev:1)
alert tcp any any -> any any (msg:"cnzz"; appid:cnzz; sid:1001760; rev:1)
alert tcp any any -> any any (msg:"howardforums"; appid:howardforums; sid:1001761; rev:1)
alert tcp any any -> any any (msg:"softonic"; appid:softonic; sid:1001762; rev:1)
alert tcp any any -> any any (msg:"booking.com"; appid:booking.com; sid:1001763; rev:1)
alert tcp any any -> any any (msg:"concur"; appid:concur; sid:1001764; rev:1)
alert tcp any any -> any any (msg:"teachertube"; appid:teachertube; sid:1001765; rev:1)
alert tcp any any -> any any (msg:"rambler"; appid:rambler; sid:1001766; rev:1)
alert tcp any any -> any any (msg:"earthcam"; appid:earthcam; sid:1001767; rev:1)
alert tcp any any -> any any (msg:"softpedia"; appid:softpedia; sid:1001768; rev:1)
alert tcp any any -> any any (msg:"techcrunch"; appid:techcrunch; sid:1001769; rev:1)
alert tcp any any -> any any (msg:"hyves"; appid:hyves; sid:1001770; rev:1)
alert tcp any any -> any any (msg:"la_times"; appid:la_times; sid:1001771; rev:1)
alert tcp any any -> any any (msg:"china_news"; appid:china_news; sid:1001772; rev:1)
alert tcp any any -> any any (msg:"nico_douga_video"; appid:nico_douga_video; sid:1001773; rev:1)
alert tcp any any -> any any (msg:"aliwangwang"; appid:aliwangwang; sid:1001774; rev:1)
alert tcp any any -> any any (msg:"wechat"; appid:wechat; sid:1001775; rev:1)
alert tcp any any -> any any (msg:"wechat-media"; appid:wechat-media; sid:1001776; rev:1)
alert tcp any any -> any any (msg:"xbox_live_sites"; appid:xbox_live_sites; sid:1001777; rev:1)
alert tcp any any -> any any (msg:"windows_phone_sites"; appid:windows_phone_sites; sid:1001778; rev:1)
alert tcp any any -> any any (msg:"sopcast"; appid:sopcast; sid:1001779; rev:1)
alert tcp any any -> any any (msg:"ultrasurf"; appid:ultrasurf; sid:1001780; rev:1)
alert tcp any any -> any any (msg:"sharethis"; appid:sharethis; sid:1001781; rev:1)
alert tcp any any -> any any (msg:"lockss"; appid:lockss; sid:1001782; rev:1)
alert tcp any any -> any any (msg:"gomtv_remote_control"; appid:gomtv_remote_control; sid:1001783; rev:1)
alert tcp any any -> any any (msg:"gomtv.net"; appid:gomtv.net; sid:1001784; rev:1)
alert tcp any any -> any any (msg:"gomtv.com"; appid:gomtv.com; sid:1001785; rev:1)
alert tcp any any -> any any (msg:"gotowebinar"; appid:gotowebinar; sid:1001786; rev:1)
alert tcp any any -> any any (msg:"gototraining"; appid:gototraining; sid:1001787; rev:1)
alert tcp any any -> any any (msg:"vyprvpn_login"; appid:vyprvpn_login; sid:1001788; rev:1)
alert tcp any any -> any any (msg:"tunnelbear_login"; appid:tunnelbear_login; sid:1001789; rev:1)
alert tcp any any -> any any (msg:"ivacy_login"; appid:ivacy_login; sid:1001790; rev:1)
alert tcp any any -> any any (msg:"hide_my_ass!"; appid:hide_my_ass!; sid:1001791; rev:1)
alert tcp any any -> any any (msg:"vevo.com"; appid:vevo.com; sid:1001792; rev:1)
alert tcp any any -> any any (msg:"pnas"; appid:pnas; sid:1001793; rev:1)
alert tcp any any -> any any (msg:"hbo"; appid:hbo; sid:1001794; rev:1)
alert tcp any any -> any any (msg:"stitcher"; appid:stitcher; sid:1001795; rev:1)
alert tcp any any -> any any (msg:"cisco"; appid:cisco; sid:1001796; rev:1)
alert tcp any any -> any any (msg:"baltimore_sun"; appid:baltimore_sun; sid:1001797; rev:1)
alert tcp any any -> any any (msg:"dilbert"; appid:dilbert; sid:1001798; rev:1)
alert tcp any any -> any any (msg:"google_url_shrt"; appid:google_url_shrt; sid:1001799; rev:1)
alert tcp any any -> any any (msg:"hotels"; appid:hotels; sid:1001800; rev:1)
alert tcp any any -> any any (msg:"jstor"; appid:jstor; sid:1001801; rev:1)
alert tcp any any -> any any (msg:"xiami.com"; appid:xiami.com; sid:1001802; rev:1)
alert tcp any any -> any any (msg:"inrix"; appid:inrix; sid:1001803; rev:1)
alert tcp any any -> any any (msg:"lijit"; appid:lijit; sid:1001804; rev:1)
alert tcp any any -> any any (msg:"moat"; appid:moat; sid:1001805; rev:1)
alert tcp any any -> any any (msg:"ando_media"; appid:ando_media; sid:1001806; rev:1)
alert tcp any any -> any any (msg:"break"; appid:break; sid:1001807; rev:1)
alert tcp any any -> any any (msg:"bittorrent_sync"; appid:bittorrent_sync; sid:1001808; rev:1)
alert tcp any any -> any any (msg:"printer_pro_desktop"; appid:printer_pro_desktop; sid:1001809; rev:1)
alert tcp any any -> any any (msg:"apple_music"; appid:apple_music; sid:1001810; rev:1)
alert tcp any any -> any any (msg:"hideman_login"; appid:hideman_login; sid:1001811; rev:1)
alert tcp any any -> any any (msg:"cloudnymous_login"; appid:cloudnymous_login; sid:1001812; rev:1)
alert tcp any any -> any any (msg:"vmware_vcenter_client"; appid:vmware_vcenter_client; sid:1001813; rev:1)
alert tcp any any -> any any (msg:"nat-pmp"; appid:nat-pmp; sid:1001814; rev:1)
alert tcp any any -> any any (msg:"python_urllib"; appid:python_urllib; sid:1001815; rev:1)
alert tcp any any -> any any (msg:"genieo"; appid:genieo; sid:1001816; rev:1)
alert tcp any any -> any any (msg:"mathworks"; appid:mathworks; sid:1001817; rev:1)
alert tcp any any -> any any (msg:"goodsync"; appid:goodsync; sid:1001818; rev:1)
alert tcp any any -> any any (msg:"uptodate"; appid:uptodate; sid:1001819; rev:1)
alert tcp any any -> any any (msg:"new_relic"; appid:new_relic; sid:1001820; rev:1)
alert tcp any any -> any any (msg:"worldcat"; appid:worldcat; sid:1001821; rev:1)
alert tcp any any -> any any (msg:"apple_app_store"; appid:apple_app_store; sid:1001822; rev:1)
alert tcp any any -> any any (msg:"fuyin.tv"; appid:fuyin.tv; sid:1001823; rev:1)
alert tcp any any -> any any (msg:"showtime_anytime"; appid:showtime_anytime; sid:1001824; rev:1)
alert tcp any any -> any any (msg:"drupal"; appid:drupal; sid:1001825; rev:1)
alert tcp any any -> any any (msg:"sky"; appid:sky; sid:1001826; rev:1)
alert tcp any any -> any any (msg:"arizona_public"; appid:arizona_public; sid:1001827; rev:1)
alert tcp any any -> any any (msg:"ea_games"; appid:ea_games; sid:1001828; rev:1)
alert tcp any any -> any any (msg:"tomtom"; appid:tomtom; sid:1001829; rev:1)
alert tcp any any -> any any (msg:"opendns"; appid:opendns; sid:1001830; rev:1)
alert tcp any any -> any any (msg:"gizmodo"; appid:gizmodo; sid:1001831; rev:1)
alert tcp any any -> any any (msg:"simplepie"; appid:simplepie; sid:1001832; rev:1)
alert tcp any any -> any any (msg:"sophos_live_protection"; appid:sophos_live_protection; sid:1001833; rev:1)
alert tcp any any -> any any (msg:"android_asynchronous_http_client"; appid:android_asynchronous_http_client; sid:1001834; rev:1)
alert tcp any any -> any any (msg:"vmware-vsphere"; appid:vmware-vsphere; sid:1001835; rev:1)
alert tcp any any -> any any (msg:"integromedb"; appid:integromedb; sid:1001836; rev:1)
alert tcp any any -> any any (msg:"twitter4j"; appid:twitter4j; sid:1001837; rev:1)
alert tcp any any -> any any (msg:"msnbot"; appid:msnbot; sid:1001838; rev:1)
alert tcp any any -> any any (msg:"pingdom"; appid:pingdom; sid:1001839; rev:1)
alert tcp any any -> any any (msg:"php-soap"; appid:php-soap; sid:1001840; rev:1)
alert tcp any any -> any any (msg:"leap_motion_sites"; appid:leap_motion_sites; sid:1001841; rev:1)
alert tcp any any -> any any (msg:"realplayer_cld"; appid:realplayer_cld; sid:1001842; rev:1)
alert tcp any any -> any any (msg:"ibooks"; appid:ibooks; sid:1001843; rev:1)
alert tcp any any -> any any (msg:"itunes_store"; appid:itunes_store; sid:1001844; rev:1)
alert tcp any any -> any any (msg:"realnetworks"; appid:realnetworks; sid:1001845; rev:1)
alert tcp any any -> any any (msg:"sametime"; appid:sametime; sid:1001846; rev:1)
alert tcp any any -> any any (msg:"garmin"; appid:garmin; sid:1001847; rev:1)
alert tcp any any -> any any (msg:"nexon"; appid:nexon; sid:1001848; rev:1)
alert tcp any any -> any any (msg:"samsung_push_notification"; appid:samsung_push_notification; sid:1001849; rev:1)
alert tcp any any -> any any (msg:"tvonline.cc"; appid:tvonline.cc; sid:1001850; rev:1)
alert tcp any any -> any any (msg:"bestv"; appid:bestv; sid:1001851; rev:1)
alert tcp any any -> any any (msg:"zippyshare"; appid:zippyshare; sid:1001852; rev:1)
alert tcp any any -> any any (msg:"gta_online"; appid:gta_online; sid:1001853; rev:1)
alert tcp any any -> any any (msg:"remote_ctrl_from_iphone/ipad"; appid:remote_ctrl_from_iphone/ipad; sid:1001854; rev:1)
alert tcp any any -> any any (msg:"rockstar_games"; appid:rockstar_games; sid:1001855; rev:1)
alert tcp any any -> any any (msg:"irods"; appid:irods; sid:1001856; rev:1)
alert tcp any any -> any any (msg:"nest_thermostat"; appid:nest_thermostat; sid:1001857; rev:1)
alert tcp any any -> any any (msg:"ctv"; appid:ctv; sid:1001858; rev:1)
alert tcp any any -> any any (msg:"ctv_news"; appid:ctv_news; sid:1001859; rev:1)
alert tcp any any -> any any (msg:"indiegogo"; appid:indiegogo; sid:1001860; rev:1)
alert tcp any any -> any any (msg:"kvoa.com"; appid:kvoa.com; sid:1001861; rev:1)
alert tcp any any -> any any (msg:"mailchimp"; appid:mailchimp; sid:1001862; rev:1)
alert tcp any any -> any any (msg:"movietickets"; appid:movietickets; sid:1001863; rev:1)
alert tcp any any -> any any (msg:"comcast_mail"; appid:comcast_mail; sid:1001864; rev:1)
alert tcp any any -> any any (msg:"coursera"; appid:coursera; sid:1001865; rev:1)
alert tcp any any -> any any (msg:"kodi"; appid:kodi; sid:1001866; rev:1)
alert tcp any any -> any any (msg:"network_pid_chk"; appid:network_pid_chk; sid:1001867; rev:1)
alert tcp any any -> any any (msg:"gazprom_media"; appid:gazprom_media; sid:1001868; rev:1)
alert tcp any any -> any any (msg:"tvigle"; appid:tvigle; sid:1001869; rev:1)
alert tcp any any -> any any (msg:"bandcamp"; appid:bandcamp; sid:1001870; rev:1)
alert tcp any any -> any any (msg:"netbackup"; appid:netbackup; sid:1001871; rev:1)
alert tcp any any -> any any (msg:"bluehost"; appid:bluehost; sid:1001872; rev:1)
alert tcp any any -> any any (msg:"sfgate"; appid:sfgate; sid:1001873; rev:1)
alert tcp any any -> any any (msg:"library_of_congress"; appid:library_of_congress; sid:1001874; rev:1)
alert tcp any any -> any any (msg:"overblog"; appid:overblog; sid:1001875; rev:1)
alert tcp any any -> any any (msg:"bbb"; appid:bbb; sid:1001876; rev:1)
alert tcp any any -> any any (msg:"addtoany"; appid:addtoany; sid:1001877; rev:1)
alert tcp any any -> any any (msg:"time"; appid:time; sid:1001878; rev:1)
alert tcp any any -> any any (msg:"phoca"; appid:phoca; sid:1001879; rev:1)
alert tcp any any -> any any (msg:"phpbb"; appid:phpbb; sid:1001880; rev:1)
alert tcp any any -> any any (msg:"hugedomains.com"; appid:hugedomains.com; sid:1001881; rev:1)
alert tcp any any -> any any (msg:"gnu_project"; appid:gnu_project; sid:1001882; rev:1)
alert tcp any any -> any any (msg:"lycos"; appid:lycos; sid:1001883; rev:1)
alert tcp any any -> any any (msg:"connman"; appid:connman; sid:1001884; rev:1)
alert tcp any any -> any any (msg:"creative_commons"; appid:creative_commons; sid:1001885; rev:1)
alert tcp any any -> any any (msg:"nai"; appid:nai; sid:1001886; rev:1)
alert tcp any any -> any any (msg:"joomla"; appid:joomla; sid:1001887; rev:1)
alert tcp any any -> any any (msg:"tinyurl"; appid:tinyurl; sid:1001888; rev:1)
alert tcp any any -> any any (msg:"amazon_cloud_player"; appid:amazon_cloud_player; sid:1001889; rev:1)
alert tcp any any -> any any (msg:"jimdo"; appid:jimdo; sid:1001890; rev:1)
alert tcp any any -> any any (msg:"standford_univ"; appid:standford_univ; sid:1001891; rev:1)
alert tcp any any -> any any (msg:"harvard_univ"; appid:harvard_univ; sid:1001892; rev:1)
alert tcp any any -> any any (msg:"erecht24"; appid:erecht24; sid:1001893; rev:1)
alert tcp any any -> any any (msg:"european_union"; appid:european_union; sid:1001894; rev:1)
alert tcp any any -> any any (msg:"bitly"; appid:bitly; sid:1001895; rev:1)
alert tcp any any -> any any (msg:"viddler"; appid:viddler; sid:1001896; rev:1)
alert tcp any any -> any any (msg:"merriam-webster"; appid:merriam-webster; sid:1001897; rev:1)
alert tcp any any -> any any (msg:"websense"; appid:websense; sid:1001898; rev:1)
alert tcp any any -> any any (msg:"zbigz"; appid:zbigz; sid:1001899; rev:1)
alert tcp any any -> any any (msg:"zulily"; appid:zulily; sid:1001900; rev:1)
alert tcp any any -> any any (msg:"zattoo"; appid:zattoo; sid:1001901; rev:1)
alert tcp any any -> any any (msg:"xfire"; appid:xfire; sid:1001902; rev:1)
alert tcp any any -> any any (msg:"parallels"; appid:parallels; sid:1001903; rev:1)
alert tcp any any -> any any (msg:"eyejot"; appid:eyejot; sid:1001904; rev:1)
alert tcp any any -> any any (msg:"dogpile"; appid:dogpile; sid:1001905; rev:1)
alert tcp any any -> any any (msg:"duckduckgo"; appid:duckduckgo; sid:1001906; rev:1)
alert tcp any any -> any any (msg:"exchange_online"; appid:exchange_online; sid:1001907; rev:1)
alert tcp any any -> any any (msg:"ms_cdn"; appid:ms_cdn; sid:1001908; rev:1)
alert tcp any any -> any any (msg:"office_365"; appid:office_365; sid:1001909; rev:1)
alert tcp any any -> any any (msg:"sharepoint_online"; appid:sharepoint_online; sid:1001910; rev:1)
alert tcp any any -> any any (msg:"tencent"; appid:tencent; sid:1001911; rev:1)
alert tcp any any -> any any (msg:"picsearch"; appid:picsearch; sid:1001912; rev:1)
alert tcp any any -> any any (msg:"fetion"; appid:fetion; sid:1001913; rev:1)
alert tcp any any -> any any (msg:"fluxiom"; appid:fluxiom; sid:1001914; rev:1)
alert tcp any any -> any any (msg:"leapfile"; appid:leapfile; sid:1001915; rev:1)
alert tcp any any -> any any (msg:"okurin"; appid:okurin; sid:1001916; rev:1)
alert tcp any any -> any any (msg:"rayfile"; appid:rayfile; sid:1001917; rev:1)
alert tcp any any -> any any (msg:"fotki"; appid:fotki; sid:1001918; rev:1)
alert tcp any any -> any any (msg:"crossloop"; appid:crossloop; sid:1001919; rev:1)
alert tcp any any -> any any (msg:"eroom"; appid:eroom; sid:1001920; rev:1)
alert tcp any any -> any any (msg:"glide"; appid:glide; sid:1001921; rev:1)
alert tcp any any -> any any (msg:"wii"; appid:wii; sid:1001922; rev:1)
alert tcp any any -> any any (msg:"shopkick"; appid:shopkick; sid:1001923; rev:1)
alert tcp any any -> any any (msg:"hangame"; appid:hangame; sid:1001924; rev:1)
alert tcp any any -> any any (msg:"sugarcrm"; appid:sugarcrm; sid:1001925; rev:1)
alert tcp any any -> any any (msg:"megaproxy"; appid:megaproxy; sid:1001926; rev:1)
alert tcp any any -> any any (msg:"kproxy"; appid:kproxy; sid:1001927; rev:1)
alert tcp any any -> any any (msg:"guardster"; appid:guardster; sid:1001928; rev:1)
alert tcp any any -> any any (msg:"flyproxy"; appid:flyproxy; sid:1001929; rev:1)
alert tcp any any -> any any (msg:"coral_cdn"; appid:coral_cdn; sid:1001930; rev:1)
alert tcp any any -> any any (msg:"pastebin"; appid:pastebin; sid:1001931; rev:1)
alert tcp any any -> any any (msg:"zhihu"; appid:zhihu; sid:1001932; rev:1)
alert tcp any any -> any any (msg:"twiddla"; appid:twiddla; sid:1001933; rev:1)
alert tcp any any -> any any (msg:"quora"; appid:quora; sid:1001934; rev:1)
alert tcp any any -> any any (msg:"yahoo_mobage"; appid:yahoo_mobage; sid:1001935; rev:1)
alert tcp any any -> any any (msg:"adobe_analytics"; appid:adobe_analytics; sid:1001936; rev:1)
alert tcp any any -> any any (msg:"ado_tube"; appid:ado_tube; sid:1001937; rev:1)
alert tcp any any -> any any (msg:"adroll"; appid:adroll; sid:1001938; rev:1)
alert tcp any any -> any any (msg:"adsame"; appid:adsame; sid:1001939; rev:1)
alert tcp any any -> any any (msg:"ad-x_tracking"; appid:ad-x_tracking; sid:1001940; rev:1)
alert tcp any any -> any any (msg:"allegro.pl"; appid:allegro.pl; sid:1001941; rev:1)
alert tcp any any -> any any (msg:"autohome.com.cn"; appid:autohome.com.cn; sid:1001942; rev:1)
alert tcp any any -> any any (msg:"ganji"; appid:ganji; sid:1001943; rev:1)
alert tcp any any -> any any (msg:"hao123.com"; appid:hao123.com; sid:1001944; rev:1)
alert tcp any any -> any any (msg:"ifeng.com"; appid:ifeng.com; sid:1001945; rev:1)
alert tcp any any -> any any (msg:"bbc_iplayer"; appid:bbc_iplayer; sid:1001946; rev:1)
alert tcp any any -> any any (msg:"istock"; appid:istock; sid:1001947; rev:1)
alert tcp any any -> any any (msg:"kooora.com"; appid:kooora.com; sid:1001948; rev:1)
alert tcp any any -> any any (msg:"mercado_livre"; appid:mercado_livre; sid:1001949; rev:1)
alert tcp any any -> any any (msg:"mop.com"; appid:mop.com; sid:1001950; rev:1)
alert tcp any any -> any any (msg:"motley_fool"; appid:motley_fool; sid:1001951; rev:1)
alert tcp any any -> any any (msg:"sitescout"; appid:sitescout; sid:1001952; rev:1)
alert tcp any any -> any any (msg:"zol.com.cn"; appid:zol.com.cn; sid:1001953; rev:1)
alert tcp any any -> any any (msg:"bloglovin"; appid:bloglovin; sid:1001954; rev:1)
alert tcp any any -> any any (msg:"baidu_movies"; appid:baidu_movies; sid:1001955; rev:1)
alert tcp any any -> any any (msg:"microsoft_crm_dynamics"; appid:microsoft_crm_dynamics; sid:1001956; rev:1)
alert tcp any any -> any any (msg:"gbridge"; appid:gbridge; sid:1001957; rev:1)
alert tcp any any -> any any (msg:"mikogo"; appid:mikogo; sid:1001958; rev:1)
alert tcp any any -> any any (msg:"streamwork"; appid:streamwork; sid:1001959; rev:1)
alert tcp any any -> any any (msg:"xunlei_kankan"; appid:xunlei_kankan; sid:1001960; rev:1)
alert tcp any any -> any any (msg:"google_groups"; appid:google_groups; sid:1001961; rev:1)
alert tcp any any -> any any (msg:"google+_photos"; appid:google+_photos; sid:1001962; rev:1)
alert tcp any any -> any any (msg:"google+_videos"; appid:google+_videos; sid:1001963; rev:1)
alert tcp any any -> any any (msg:"myspace_photos"; appid:myspace_photos; sid:1001964; rev:1)
alert tcp any any -> any any (msg:"myspace_videos"; appid:myspace_videos; sid:1001965; rev:1)
alert tcp any any -> any any (msg:"filehost.ro"; appid:filehost.ro; sid:1001966; rev:1)
alert tcp any any -> any any (msg:"gyao"; appid:gyao; sid:1001967; rev:1)
alert tcp any any -> any any (msg:"svn"; appid:svn; sid:1001968; rev:1)
alert tcp any any -> any any (msg:"quake_live"; appid:quake_live; sid:1001969; rev:1)
alert tcp any any -> any any (msg:"http2"; appid:http2; sid:1001970; rev:1)
alert tcp any any -> any any (msg:"sophos_update"; appid:sophos_update; sid:1001971; rev:1)
alert tcp any any -> any any (msg:"glype"; appid:glype; sid:1001972; rev:1)
alert tcp any any -> any any (msg:"sanook.com"; appid:sanook.com; sid:1001973; rev:1)
alert tcp any any -> any any (msg:"ammyy"; appid:ammyy; sid:1001974; rev:1)
alert tcp any any -> any any (msg:"dropbox_upload"; appid:dropbox_upload; sid:1001975; rev:1)
alert tcp any any -> any any (msg:"dropbox_downld"; appid:dropbox_downld; sid:1001976; rev:1)
alert tcp any any -> any any (msg:"dropbox_share"; appid:dropbox_share; sid:1001977; rev:1)
alert tcp any any -> any any (msg:"r6_feedfetcher"; appid:r6_feedfetcher; sid:1001978; rev:1)
alert tcp any any -> any any (msg:"vmware_horizon"; appid:vmware_horizon; sid:1001979; rev:1)
alert tcp any any -> any any (msg:"google_accounts_authentication"; appid:google_accounts_authentication; sid:1001980; rev:1)
alert tcp any any -> any any (msg:"cisco_phone"; appid:cisco_phone; sid:1001981; rev:1)
alert tcp any any -> any any (msg:"linked_profile"; appid:linked_profile; sid:1001982; rev:1)
alert tcp any any -> any any (msg:"linked_inbox"; appid:linked_inbox; sid:1001983; rev:1)
alert tcp any any -> any any (msg:"itunes_iphone"; appid:itunes_iphone; sid:1001984; rev:1)
alert tcp any any -> any any (msg:"itunes_ipod"; appid:itunes_ipod; sid:1001985; rev:1)
alert tcp any any -> any any (msg:"itunes_ipad"; appid:itunes_ipad; sid:1001986; rev:1)
alert tcp any any -> any any (msg:"fb_utilities"; appid:fb_utilities; sid:1001987; rev:1)
alert tcp any any -> any any (msg:"fb_sports"; appid:fb_sports; sid:1001988; rev:1)
alert tcp any any -> any any (msg:"fb_games"; appid:fb_games; sid:1001989; rev:1)
alert tcp any any -> any any (msg:"yixin"; appid:yixin; sid:1001990; rev:1)
alert tcp any any -> any any (msg:"shareman"; appid:shareman; sid:1001991; rev:1)
alert tcp any any -> any any (msg:"itunes_desktop"; appid:itunes_desktop; sid:1001992; rev:1)
alert tcp any any -> any any (msg:"fb_photo"; appid:fb_photo; sid:1001993; rev:1)
alert tcp any any -> any any (msg:"yahoo_login"; appid:yahoo_login; sid:1001994; rev:1)
alert tcp any any -> any any (msg:"espn_video"; appid:espn_video; sid:1001995; rev:1)
alert tcp any any -> any any (msg:"fb_appl_other"; appid:fb_appl_other; sid:1001996; rev:1)
alert tcp any any -> any any (msg:"perforce"; appid:perforce; sid:1001997; rev:1)
alert tcp any any -> any any (msg:"bazaarvoice"; appid:bazaarvoice; sid:1001998; rev:1)
alert tcp any any -> any any (msg:"sccp"; appid:sccp; sid:1001999; rev:1)
alert tcp any any -> any any (msg:"ciscotelepresnc"; appid:ciscotelepresnc; sid:1002000; rev:1)
alert tcp any any -> any any (msg:"tomatopang"; appid:tomatopang; sid:1002001; rev:1)
alert tcp any any -> any any (msg:"vdolive"; appid:vdolive; sid:1002002; rev:1)
alert tcp any any -> any any (msg:"dena_websites"; appid:dena_websites; sid:1002003; rev:1)
alert tcp any any -> any any (msg:"jondo"; appid:jondo; sid:1002004; rev:1)
alert tcp any any -> any any (msg:"sina_video"; appid:sina_video; sid:1002005; rev:1)
alert tcp any any -> any any (msg:"yahoo!_flash"; appid:yahoo!_flash; sid:1002006; rev:1)
alert tcp any any -> any any (msg:"crackle_video"; appid:crackle_video; sid:1002007; rev:1)
alert tcp any any -> any any (msg:"ard"; appid:ard; sid:1002008; rev:1)
alert tcp any any -> any any (msg:"google_hangouts"; appid:google_hangouts; sid:1002009; rev:1)
alert tcp any any -> any any (msg:"linkedin_upload"; appid:linkedin_upload; sid:1002010; rev:1)
alert tcp any any -> any any (msg:"3com_amp3"; appid:3com_amp3; sid:1002011; rev:1)
alert tcp any any -> any any (msg:"access_network"; appid:access_network; sid:1002012; rev:1)
alert tcp any any -> any any (msg:"accessbuilder"; appid:accessbuilder; sid:1002013; rev:1)
alert tcp any any -> any any (msg:"aodv"; appid:aodv; sid:1002014; rev:1)
alert tcp any any -> any any (msg:"alpes"; appid:alpes; sid:1002015; rev:1)
alert tcp any any -> any any (msg:"adobe_postscript"; appid:adobe_postscript; sid:1002016; rev:1)
alert tcp any any -> any any (msg:"aeolon_core_protocol"; appid:aeolon_core_protocol; sid:1002017; rev:1)
alert tcp any any -> any any (msg:"agentx"; appid:agentx; sid:1002018; rev:1)
alert tcp any any -> any any (msg:"connendp"; appid:connendp; sid:1002019; rev:1)
alert tcp any any -> any any (msg:"powerchute"; appid:powerchute; sid:1002020; rev:1)
alert tcp any any -> any any (msg:"aminet"; appid:aminet; sid:1002021; rev:1)
alert tcp any any -> any any (msg:"apertus_tech_load_distribution"; appid:apertus_tech_load_distribution; sid:1002022; rev:1)
alert tcp any any -> any any (msg:"appleqtcsrvr"; appid:appleqtcsrvr; sid:1002023; rev:1)
alert tcp any any -> any any (msg:"aep"; appid:aep; sid:1002024; rev:1)
alert tcp any any -> any any (msg:"nbp"; appid:nbp; sid:1002025; rev:1)
alert tcp any any -> any any (msg:"appletalk_routing_maintenance"; appid:appletalk_routing_maintenance; sid:1002026; rev:1)
alert tcp any any -> any any (msg:"appletalk_203"; appid:appletalk_203; sid:1002027; rev:1)
alert tcp any any -> any any (msg:"appletalk_205"; appid:appletalk_205; sid:1002028; rev:1)
alert tcp any any -> any any (msg:"appletalk_207"; appid:appletalk_207; sid:1002029; rev:1)
alert tcp any any -> any any (msg:"appletalk_208"; appid:appletalk_208; sid:1002030; rev:1)
alert tcp any any -> any any (msg:"aurp"; appid:aurp; sid:1002031; rev:1)
alert tcp any any -> any any (msg:"appletalk_zone_information_protocol"; appid:appletalk_zone_information_protocol; sid:1002032; rev:1)
alert tcp any any -> any any (msg:"applianceware_managment_protocol"; appid:applianceware_managment_protocol; sid:1002033; rev:1)
alert tcp any any -> any any (msg:"acap"; appid:acap; sid:1002034; rev:1)
alert tcp any any -> any any (msg:"applix_ac"; appid:applix_ac; sid:1002035; rev:1)
alert tcp any any -> any any (msg:"ariel2"; appid:ariel2; sid:1002036; rev:1)
alert tcp any any -> any any (msg:"ariel3"; appid:ariel3; sid:1002037; rev:1)
alert tcp any any -> any any (msg:"as_server_mapper"; appid:as_server_mapper; sid:1002038; rev:1)
alert tcp any any -> any any (msg:"asipregistry"; appid:asipregistry; sid:1002039; rev:1)
alert tcp any any -> any any (msg:"aurora_cmgr"; appid:aurora_cmgr; sid:1002040; rev:1)
alert tcp any any -> any any (msg:"dclink"; appid:dclink; sid:1002041; rev:1)
alert tcp any any -> any any (msg:"avian"; appid:avian; sid:1002042; rev:1)
alert tcp any any -> any any (msg:"banyan_vip"; appid:banyan_vip; sid:1002043; rev:1)
alert tcp any any -> any any (msg:"banyan-rpc"; appid:banyan-rpc; sid:1002044; rev:1)
alert tcp any any -> any any (msg:"rsh-spx"; appid:rsh-spx; sid:1002045; rev:1)
alert tcp any any -> any any (msg:"bgs-nsi"; appid:bgs-nsi; sid:1002046; rev:1)
alert tcp any any -> any any (msg:"bmpp"; appid:bmpp; sid:1002047; rev:1)
alert tcp any any -> any any (msg:"borland_dsj"; appid:borland_dsj; sid:1002048; rev:1)
alert tcp any any -> any any (msg:"bacnet"; appid:bacnet; sid:1002049; rev:1)
alert tcp any any -> any any (msg:"cab_protocol"; appid:cab_protocol; sid:1002050; rev:1)
alert tcp any any -> any any (msg:"cabletron_management_protocol"; appid:cabletron_management_protocol; sid:1002051; rev:1)
alert tcp any any -> any any (msg:"cadlock"; appid:cadlock; sid:1002052; rev:1)
alert tcp any any -> any any (msg:"call_of_duty"; appid:call_of_duty; sid:1002053; rev:1)
alert tcp any any -> any any (msg:"campaign contribution disclosures"; appid:campaign contribution disclosures; sid:1002054; rev:1)
alert tcp any any -> any any (msg:"chat"; appid:chat; sid:1002055; rev:1)
alert tcp any any -> any any (msg:"chshell"; appid:chshell; sid:1002056; rev:1)
alert tcp any any -> any any (msg:"cimplex"; appid:cimplex; sid:1002057; rev:1)
alert tcp any any -> any any (msg:"cisco_nac"; appid:cisco_nac; sid:1002058; rev:1)
alert tcp any any -> any any (msg:"citrix_static"; appid:citrix_static; sid:1002059; rev:1)
alert tcp any any -> any any (msg:"cmip/tcp_manager"; appid:cmip/tcp_manager; sid:1002060; rev:1)
alert tcp any any -> any any (msg:"cfdp"; appid:cfdp; sid:1002061; rev:1)
alert tcp any any -> any any (msg:"collaborator"; appid:collaborator; sid:1002062; rev:1)
alert tcp any any -> any any (msg:"commerce"; appid:commerce; sid:1002063; rev:1)
alert tcp any any -> any any (msg:"common_trace_facility"; appid:common_trace_facility; sid:1002064; rev:1)
alert tcp any any -> any any (msg:"covia"; appid:covia; sid:1002065; rev:1)
alert tcp any any -> any any (msg:"cddb"; appid:cddb; sid:1002066; rev:1)
alert tcp any any -> any any (msg:"cpq-wbem"; appid:cpq-wbem; sid:1002067; rev:1)
alert tcp any any -> any any (msg:"ca_intl_license_server"; appid:ca_intl_license_server; sid:1002068; rev:1)
alert tcp any any -> any any (msg:"synergy"; appid:synergy; sid:1002069; rev:1)
alert tcp any any -> any any (msg:"csta"; appid:csta; sid:1002070; rev:1)
alert tcp any any -> any any (msg:"con"; appid:con; sid:1002071; rev:1)
alert tcp any any -> any any (msg:"contentserver"; appid:contentserver; sid:1002072; rev:1)
alert tcp any any -> any any (msg:"corerjd"; appid:corerjd; sid:1002073; rev:1)
alert tcp any any -> any any (msg:"courier_mail_server"; appid:courier_mail_server; sid:1002074; rev:1)
alert tcp any any -> any any (msg:"cray_network_semaphore_server"; appid:cray_network_semaphore_server; sid:1002075; rev:1)
alert tcp any any -> any any (msg:"sfs_config_server"; appid:sfs_config_server; sid:1002076; rev:1)
alert tcp any any -> any any (msg:"cray_unified_resource_manager"; appid:cray_unified_resource_manager; sid:1002077; rev:1)
alert tcp any any -> any any (msg:"creative_partner"; appid:creative_partner; sid:1002078; rev:1)
alert tcp any any -> any any (msg:"creative_server"; appid:creative_server; sid:1002079; rev:1)
alert tcp any any -> any any (msg:"cryptoadmin"; appid:cryptoadmin; sid:1002080; rev:1)
alert tcp any any -> any any (msg:"csnet_mailbox_name_nameserver"; appid:csnet_mailbox_name_nameserver; sid:1002081; rev:1)
alert tcp any any -> any any (msg:"customer_ixchange"; appid:customer_ixchange; sid:1002082; rev:1)
alert tcp any any -> any any (msg:"cvc_hostd"; appid:cvc_hostd; sid:1002083; rev:1)
alert tcp any any -> any any (msg:"cvs_pserver"; appid:cvs_pserver; sid:1002084; rev:1)
alert tcp any any -> any any (msg:"cybercash"; appid:cybercash; sid:1002085; rev:1)
alert tcp any any -> any any (msg:"cycleserv"; appid:cycleserv; sid:1002086; rev:1)
alert tcp any any -> any any (msg:"cycleserv2"; appid:cycleserv2; sid:1002087; rev:1)
alert tcp any any -> any any (msg:"retrospect"; appid:retrospect; sid:1002088; rev:1)
alert tcp any any -> any any (msg:"dataramp_svr"; appid:dataramp_svr; sid:1002089; rev:1)
alert tcp any any -> any any (msg:"datarampsrvsec"; appid:datarampsrvsec; sid:1002090; rev:1)
alert tcp any any -> any any (msg:"epmap"; appid:epmap; sid:1002091; rev:1)
alert tcp any any -> any any (msg:"dctp"; appid:dctp; sid:1002092; rev:1)
alert tcp any any -> any any (msg:"ddm_dfm"; appid:ddm_dfm; sid:1002093; rev:1)
alert tcp any any -> any any (msg:"ddm_rrda"; appid:ddm_rrda; sid:1002094; rev:1)
alert tcp any any -> any any (msg:"dec_dlm"; appid:dec_dlm; sid:1002095; rev:1)
alert tcp any any -> any any (msg:"decap"; appid:decap; sid:1002096; rev:1)
alert tcp any any -> any any (msg:"decbsrv"; appid:decbsrv; sid:1002097; rev:1)
alert tcp any any -> any any (msg:"dei-icda"; appid:dei-icda; sid:1002098; rev:1)
alert tcp any any -> any any (msg:"desknet's"; appid:desknet's; sid:1002099; rev:1)
alert tcp any any -> any any (msg:"device"; appid:device; sid:1002100; rev:1)
alert tcp any any -> any any (msg:"dhcp_failover"; appid:dhcp_failover; sid:1002101; rev:1)
alert tcp any any -> any any (msg:"dhcp_failover_2"; appid:dhcp_failover_2; sid:1002102; rev:1)
alert tcp any any -> any any (msg:"digital-vrc"; appid:digital-vrc; sid:1002103; rev:1)
alert tcp any any -> any any (msg:"direct_tv_software_updates"; appid:direct_tv_software_updates; sid:1002104; rev:1)
alert tcp any any -> any any (msg:"direct_tv_tickers"; appid:direct_tv_tickers; sid:1002105; rev:1)
alert tcp any any -> any any (msg:"directplay"; appid:directplay; sid:1002106; rev:1)
alert tcp any any -> any any (msg:"directplay8"; appid:directplay8; sid:1002107; rev:1)
alert tcp any any -> any any (msg:"directv_data_catalog"; appid:directv_data_catalog; sid:1002108; rev:1)
alert tcp any any -> any any (msg:"directv_webcasting"; appid:directv_webcasting; sid:1002109; rev:1)
alert tcp any any -> any any (msg:"distcc"; appid:distcc; sid:1002110; rev:1)
alert tcp any any -> any any (msg:"ddm"; appid:ddm; sid:1002111; rev:1)
alert tcp any any -> any any (msg:"doom"; appid:doom; sid:1002112; rev:1)
alert tcp any any -> any any (msg:"dwr"; appid:dwr; sid:1002113; rev:1)
alert tcp any any -> any any (msg:"edonkey_static"; appid:edonkey_static; sid:1002114; rev:1)
alert tcp any any -> any any (msg:"emc_smartpackets"; appid:emc_smartpackets; sid:1002115; rev:1)
alert tcp any any -> any any (msg:"entomb"; appid:entomb; sid:1002116; rev:1)
alert tcp any any -> any any (msg:"entrust_administration_service_handler"; appid:entrust_administration_service_handler; sid:1002117; rev:1)
alert tcp any any -> any any (msg:"entrust-kmsh"; appid:entrust-kmsh; sid:1002118; rev:1)
alert tcp any any -> any any (msg:"entrust_sps"; appid:entrust_sps; sid:1002119; rev:1)
alert tcp any any -> any any (msg:"entrust-aaas"; appid:entrust-aaas; sid:1002120; rev:1)
alert tcp any any -> any any (msg:"entrust-aams"; appid:entrust-aams; sid:1002121; rev:1)
alert tcp any any -> any any (msg:"errlog copy/server daemon"; appid:errlog copy/server daemon; sid:1002122; rev:1)
alert tcp any any -> any any (msg:"escp"; appid:escp; sid:1002123; rev:1)
alert tcp any any -> any any (msg:"esignal"; appid:esignal; sid:1002124; rev:1)
alert tcp any any -> any any (msg:"xtp"; appid:xtp; sid:1002125; rev:1)
alert tcp any any -> any any (msg:"fcp"; appid:fcp; sid:1002126; rev:1)
alert tcp any any -> any any (msg:"flexlm"; appid:flexlm; sid:1002127; rev:1)
alert tcp any any -> any any (msg:"ftp_software_agent_system"; appid:ftp_software_agent_system; sid:1002128; rev:1)
alert tcp any any -> any any (msg:"fujitsu_device_control"; appid:fujitsu_device_control; sid:1002129; rev:1)
alert tcp any any -> any any (msg:"gdomap"; appid:gdomap; sid:1002130; rev:1)
alert tcp any any -> any any (msg:"gds_database"; appid:gds_database; sid:1002131; rev:1)
alert tcp any any -> any any (msg:"ginad"; appid:ginad; sid:1002132; rev:1)
alert tcp any any -> any any (msg:"gsi-ftp"; appid:gsi-ftp; sid:1002133; rev:1)
alert tcp any any -> any any (msg:"gnu_gen_678"; appid:gnu_gen_678; sid:1002134; rev:1)
alert tcp any any -> any any (msg:"gkrellm"; appid:gkrellm; sid:1002135; rev:1)
alert tcp any any -> any any (msg:"goboogy"; appid:goboogy; sid:1002136; rev:1)
alert tcp any any -> any any (msg:"gotodevice"; appid:gotodevice; sid:1002137; rev:1)
alert tcp any any -> any any (msg:"graphics"; appid:graphics; sid:1002138; rev:1)
alert tcp any any -> any any (msg:"graphon_login"; appid:graphon_login; sid:1002139; rev:1)
alert tcp any any -> any any (msg:"groove"; appid:groove; sid:1002140; rev:1)
alert tcp any any -> any any (msg:"ha-cluster"; appid:ha-cluster; sid:1002141; rev:1)
alert tcp any any -> any any (msg:"hardware_control_protocol_wismar"; appid:hardware_control_protocol_wismar; sid:1002142; rev:1)
alert tcp any any -> any any (msg:"hello_port"; appid:hello_port; sid:1002143; rev:1)
alert tcp any any -> any any (msg:"heroix_longitude"; appid:heroix_longitude; sid:1002144; rev:1)
alert tcp any any -> any any (msg:"hitachi_universal_storage_platform"; appid:hitachi_universal_storage_platform; sid:1002145; rev:1)
alert tcp any any -> any any (msg:"hmmp_indication"; appid:hmmp_indication; sid:1002146; rev:1)
alert tcp any any -> any any (msg:"hmmp_operation"; appid:hmmp_operation; sid:1002147; rev:1)
alert tcp any any -> any any (msg:"hap"; appid:hap; sid:1002148; rev:1)
alert tcp any any -> any any (msg:"hp_network_management_center"; appid:hp_network_management_center; sid:1002149; rev:1)
alert tcp any any -> any any (msg:"http_rpc_ep_map"; appid:http_rpc_ep_map; sid:1002150; rev:1)
alert tcp any any -> any any (msg:"hybrid_point_of_presence"; appid:hybrid_point_of_presence; sid:1002151; rev:1)
alert tcp any any -> any any (msg:"hyperwave-isp"; appid:hyperwave-isp; sid:1002152; rev:1)
alert tcp any any -> any any (msg:"iafdbase"; appid:iafdbase; sid:1002153; rev:1)
alert tcp any any -> any any (msg:"iafserver"; appid:iafserver; sid:1002154; rev:1)
alert tcp any any -> any any (msg:"ibm_director"; appid:ibm_director; sid:1002155; rev:1)
alert tcp any any -> any any (msg:"ibm_netview_dm"; appid:ibm_netview_dm; sid:1002156; rev:1)
alert tcp any any -> any any (msg:"ibm_netview_dm/6000_server/client"; appid:ibm_netview_dm/6000_server/client; sid:1002157; rev:1)
alert tcp any any -> any any (msg:"icl_conetion_locate_server"; appid:icl_conetion_locate_server; sid:1002158; rev:1)
alert tcp any any -> any any (msg:"icl_conetion_server_info"; appid:icl_conetion_server_info; sid:1002159; rev:1)
alert tcp any any -> any any (msg:"idfp"; appid:idfp; sid:1002160; rev:1)
alert tcp any any -> any any (msg:"ieee-mms-ssl"; appid:ieee-mms-ssl; sid:1002161; rev:1)
alert tcp any any -> any any (msg:"imp_logical_address_maintenance"; appid:imp_logical_address_maintenance; sid:1002162; rev:1)
alert tcp any any -> any any (msg:"intecourier"; appid:intecourier; sid:1002163; rev:1)
alert tcp any any -> any any (msg:"integra_software_management_environment"; appid:integra_software_management_environment; sid:1002164; rev:1)
alert tcp any any -> any any (msg:"ibp"; appid:ibp; sid:1002165; rev:1)
alert tcp any any -> any any (msg:"internet_configuration_manager"; appid:internet_configuration_manager; sid:1002166; rev:1)
alert tcp any any -> any any (msg:"internet_telephony_tool"; appid:internet_telephony_tool; sid:1002167; rev:1)
alert tcp any any -> any any (msg:"cu-seeme"; appid:cu-seeme; sid:1002168; rev:1)
alert tcp any any -> any any (msg:"ipx_over_udp"; appid:ipx_over_udp; sid:1002169; rev:1)
alert tcp any any -> any any (msg:"intrinsa"; appid:intrinsa; sid:1002170; rev:1)
alert tcp any any -> any any (msg:"ipcd"; appid:ipcd; sid:1002171; rev:1)
alert tcp any any -> any any (msg:"ipdd"; appid:ipdd; sid:1002172; rev:1)
alert tcp any any -> any any (msg:"kali"; appid:kali; sid:1002173; rev:1)
alert tcp any any -> any any (msg:"irc-serv"; appid:irc-serv; sid:1002174; rev:1)
alert tcp any any -> any any (msg:"iso_ill_protocol"; appid:iso_ill_protocol; sid:1002175; rev:1)
alert tcp any any -> any any (msg:"iso_transport_class_2_non-control_over_tcp"; appid:iso_transport_class_2_non-control_over_tcp; sid:1002176; rev:1)
alert tcp any any -> any any (msg:"iso-tp0"; appid:iso-tp0; sid:1002177; rev:1)
alert tcp any any -> any any (msg:"itm-mcell-s"; appid:itm-mcell-s; sid:1002178; rev:1)
alert tcp any any -> any any (msg:"kerberos_administration"; appid:kerberos_administration; sid:1002179; rev:1)
alert tcp any any -> any any (msg:"key_server"; appid:key_server; sid:1002180; rev:1)
alert tcp any any -> any any (msg:"klogin"; appid:klogin; sid:1002181; rev:1)
alert tcp any any -> any any (msg:"konspire2b"; appid:konspire2b; sid:1002182; rev:1)
alert tcp any any -> any any (msg:"kpasswd"; appid:kpasswd; sid:1002183; rev:1)
alert tcp any any -> any any (msg:"kshell"; appid:kshell; sid:1002184; rev:1)
alert tcp any any -> any any (msg:"ldp"; appid:ldp; sid:1002185; rev:1)
alert tcp any any -> any any (msg:"lanserver"; appid:lanserver; sid:1002186; rev:1)
alert tcp any any -> any any (msg:"lwapp"; appid:lwapp; sid:1002187; rev:1)
alert tcp any any -> any any (msg:"ljk-login"; appid:ljk-login; sid:1002188; rev:1)
alert tcp any any -> any any (msg:"locus_pc-interface_conn_server"; appid:locus_pc-interface_conn_server; sid:1002189; rev:1)
alert tcp any any -> any any (msg:"loglogic"; appid:loglogic; sid:1002190; rev:1)
alert tcp any any -> any any (msg:"macos_server_admin"; appid:macos_server_admin; sid:1002191; rev:1)
alert tcp any any -> any any (msg:"msa"; appid:msa; sid:1002192; rev:1)
alert tcp any any -> any any (msg:"mailbox-lm"; appid:mailbox-lm; sid:1002193; rev:1)
alert tcp any any -> any any (msg:"maitrd"; appid:maitrd; sid:1002194; rev:1)
alert tcp any any -> any any (msg:"management_utility"; appid:management_utility; sid:1002195; rev:1)
alert tcp any any -> any any (msg:"mcns-sec"; appid:mcns-sec; sid:1002196; rev:1)
alert tcp any any -> any any (msg:"mdc-portmapper"; appid:mdc-portmapper; sid:1002197; rev:1)
alert tcp any any -> any any (msg:"memcomm"; appid:memcomm; sid:1002198; rev:1)
alert tcp any any -> any any (msg:"meregister"; appid:meregister; sid:1002199; rev:1)
alert tcp any any -> any any (msg:"meter"; appid:meter; sid:1002200; rev:1)
alert tcp any any -> any any (msg:"micom-pfs"; appid:micom-pfs; sid:1002201; rev:1)
alert tcp any any -> any any (msg:"micromuse-lm"; appid:micromuse-lm; sid:1002202; rev:1)
alert tcp any any -> any any (msg:"microsoft_global_catalog"; appid:microsoft_global_catalog; sid:1002203; rev:1)
alert tcp any any -> any any (msg:"microsoft_rome"; appid:microsoft_rome; sid:1002204; rev:1)
alert tcp any any -> any any (msg:"microsoft_shuttle"; appid:microsoft_shuttle; sid:1002205; rev:1)
alert tcp any any -> any any (msg:"microsoft_system_center_operations_manager"; appid:microsoft_system_center_operations_manager; sid:1002206; rev:1)
alert tcp any any -> any any (msg:"mit_ml_device"; appid:mit_ml_device; sid:1002207; rev:1)
alert tcp any any -> any any (msg:"mobilip-mn"; appid:mobilip-mn; sid:1002208; rev:1)
alert tcp any any -> any any (msg:"mobility_xe_protocol"; appid:mobility_xe_protocol; sid:1002209; rev:1)
alert tcp any any -> any any (msg:"mondex"; appid:mondex; sid:1002210; rev:1)
alert tcp any any -> any any (msg:"monitor"; appid:monitor; sid:1002211; rev:1)
alert tcp any any -> any any (msg:"mpm_flags_protocol"; appid:mpm_flags_protocol; sid:1002212; rev:1)
alert tcp any any -> any any (msg:"ms_exchange_routing"; appid:ms_exchange_routing; sid:1002213; rev:1)
alert tcp any any -> any any (msg:"msg-icp"; appid:msg-icp; sid:1002214; rev:1)
alert tcp any any -> any any (msg:"bundle_discovery_protocol"; appid:bundle_discovery_protocol; sid:1002215; rev:1)
alert tcp any any -> any any (msg:"mrm"; appid:mrm; sid:1002216; rev:1)
alert tcp any any -> any any (msg:"multiling_http"; appid:multiling_http; sid:1002217; rev:1)
alert tcp any any -> any any (msg:"mylex-mapd"; appid:mylex-mapd; sid:1002218; rev:1)
alert tcp any any -> any any (msg:"nest_protocol"; appid:nest_protocol; sid:1002219; rev:1)
alert tcp any any -> any any (msg:"netgw"; appid:netgw; sid:1002220; rev:1)
alert tcp any any -> any any (msg:"netix_mpp"; appid:netix_mpp; sid:1002221; rev:1)
alert tcp any any -> any any (msg:"netnews"; appid:netnews; sid:1002222; rev:1)
alert tcp any any -> any any (msg:"netnews_administration_system"; appid:netnews_administration_system; sid:1002223; rev:1)
alert tcp any any -> any any (msg:"netop_remote_control"; appid:netop_remote_control; sid:1002224; rev:1)
alert tcp any any -> any any (msg:"network_based_rev._cont._sys."; appid:network_based_rev._cont._sys.; sid:1002225; rev:1)
alert tcp any any -> any any (msg:"network_innovations_multiplex"; appid:network_innovations_multiplex; sid:1002226; rev:1)
alert tcp any any -> any any (msg:"nmap"; appid:nmap; sid:1002227; rev:1)
alert tcp any any -> any any (msg:"nqs"; appid:nqs; sid:1002228; rev:1)
alert tcp any any -> any any (msg:"network_systems"; appid:network_systems; sid:1002229; rev:1)
alert tcp any any -> any any (msg:"networked_media_streaming_protocol"; appid:networked_media_streaming_protocol; sid:1002230; rev:1)
alert tcp any any -> any any (msg:"new_who"; appid:new_who; sid:1002231; rev:1)
alert tcp any any -> any any (msg:"nfs_lock_daemon_manager"; appid:nfs_lock_daemon_manager; sid:1002232; rev:1)
alert tcp any any -> any any (msg:"nlogin"; appid:nlogin; sid:1002233; rev:1)
alert tcp any any -> any any (msg:"novadigm_edm"; appid:novadigm_edm; sid:1002234; rev:1)
alert tcp any any -> any any (msg:"novell_netware_over_ip"; appid:novell_netware_over_ip; sid:1002235; rev:1)
alert tcp any any -> any any (msg:"npmp_trap"; appid:npmp_trap; sid:1002236; rev:1)
alert tcp any any -> any any (msg:"npmp-gui"; appid:npmp-gui; sid:1002237; rev:1)
alert tcp any any -> any any (msg:"npmp-local"; appid:npmp-local; sid:1002238; rev:1)
alert tcp any any -> any any (msg:"nsw_user_system_fe"; appid:nsw_user_system_fe; sid:1002239; rev:1)
alert tcp any any -> any any (msg:"obex"; appid:obex; sid:1002240; rev:1)
alert tcp any any -> any any (msg:"ocs_cmu"; appid:ocs_cmu; sid:1002241; rev:1)
alert tcp any any -> any any (msg:"ohimsrv"; appid:ohimsrv; sid:1002242; rev:1)
alert tcp any any -> any any (msg:"omginitialrefs"; appid:omginitialrefs; sid:1002243; rev:1)
alert tcp any any -> any any (msg:"omserv"; appid:omserv; sid:1002244; rev:1)
alert tcp any any -> any any (msg:"opalis-rdv"; appid:opalis-rdv; sid:1002245; rev:1)
alert tcp any any -> any any (msg:"openvms-sysipc"; appid:openvms-sysipc; sid:1002246; rev:1)
alert tcp any any -> any any (msg:"operations_manager_-_health_service"; appid:operations_manager_-_health_service; sid:1002247; rev:1)
alert tcp any any -> any any (msg:"oracle"; appid:oracle; sid:1002248; rev:1)
alert tcp any any -> any any (msg:"oracle_coauthor"; appid:oracle_coauthor; sid:1002249; rev:1)
alert tcp any any -> any any (msg:"oracle_names"; appid:oracle_names; sid:1002250; rev:1)
alert tcp any any -> any any (msg:"oracle_net8_cma"; appid:oracle_net8_cma; sid:1002251; rev:1)
alert tcp any any -> any any (msg:"oracle_net8_adm"; appid:oracle_net8_adm; sid:1002252; rev:1)
alert tcp any any -> any any (msg:"oracle_tcp/ip_listener"; appid:oracle_tcp/ip_listener; sid:1002253; rev:1)
alert tcp any any -> any any (msg:"orbix_2000_config"; appid:orbix_2000_config; sid:1002254; rev:1)
alert tcp any any -> any any (msg:"orbix_2000_loc"; appid:orbix_2000_loc; sid:1002255; rev:1)
alert tcp any any -> any any (msg:"orbix_2000_ssl"; appid:orbix_2000_ssl; sid:1002256; rev:1)
alert tcp any any -> any any (msg:"p10"; appid:p10; sid:1002257; rev:1)
alert tcp any any -> any any (msg:"parsec_gameserver"; appid:parsec_gameserver; sid:1002258; rev:1)
alert tcp any any -> any any (msg:"passgo_technologies_service"; appid:passgo_technologies_service; sid:1002259; rev:1)
alert tcp any any -> any any (msg:"password_change"; appid:password_change; sid:1002260; rev:1)
alert tcp any any -> any any (msg:"pdl_data_streaming_port"; appid:pdl_data_streaming_port; sid:1002261; rev:1)
alert tcp any any -> any any (msg:"pov-ray"; appid:pov-ray; sid:1002262; rev:1)
alert tcp any any -> any any (msg:"personal_link"; appid:personal_link; sid:1002263; rev:1)
alert tcp any any -> any any (msg:"pharos_psrserver"; appid:pharos_psrserver; sid:1002264; rev:1)
alert tcp any any -> any any (msg:"philips_video-conferencing"; appid:philips_video-conferencing; sid:1002265; rev:1)
alert tcp any any -> any any (msg:"phonebook"; appid:phonebook; sid:1002266; rev:1)
alert tcp any any -> any any (msg:"photuris"; appid:photuris; sid:1002267; rev:1)
alert tcp any any -> any any (msg:"pim-rp-disc"; appid:pim-rp-disc; sid:1002268; rev:1)
alert tcp any any -> any any (msg:"pirp"; appid:pirp; sid:1002269; rev:1)
alert tcp any any -> any any (msg:"plus_fives_mumps"; appid:plus_fives_mumps; sid:1002270; rev:1)
alert tcp any any -> any any (msg:"ptp_event"; appid:ptp_event; sid:1002271; rev:1)
alert tcp any any -> any any (msg:"papi"; appid:papi; sid:1002272; rev:1)
alert tcp any any -> any any (msg:"prm_node_man"; appid:prm_node_man; sid:1002273; rev:1)
alert tcp any any -> any any (msg:"prm_sys_man"; appid:prm_sys_man; sid:1002274; rev:1)
alert tcp any any -> any any (msg:"ptc_name_service"; appid:ptc_name_service; sid:1002275; rev:1)
alert tcp any any -> any any (msg:"ptp_general"; appid:ptp_general; sid:1002276; rev:1)
alert tcp any any -> any any (msg:"pump"; appid:pump; sid:1002277; rev:1)
alert tcp any any -> any any (msg:"purenoise"; appid:purenoise; sid:1002278; rev:1)
alert tcp any any -> any any (msg:"qrh"; appid:qrh; sid:1002279; rev:1)
alert tcp any any -> any any (msg:"qmqp"; appid:qmqp; sid:1002280; rev:1)
alert tcp any any -> any any (msg:"quotad"; appid:quotad; sid:1002281; rev:1)
alert tcp any any -> any any (msg:"radio_control_protocol"; appid:radio_control_protocol; sid:1002282; rev:1)
alert tcp any any -> any any (msg:"rational_method_composer"; appid:rational_method_composer; sid:1002283; rev:1)
alert tcp any any -> any any (msg:"radmin"; appid:radmin; sid:1002284; rev:1)
alert tcp any any -> any any (msg:"rda"; appid:rda; sid:1002285; rev:1)
alert tcp any any -> any any (msg:"rmcp"; appid:rmcp; sid:1002286; rev:1)
alert tcp any any -> any any (msg:"remote_method_invocation_activation"; appid:remote_method_invocation_activation; sid:1002287; rev:1)
alert tcp any any -> any any (msg:"rmtis"; appid:rmtis; sid:1002288; rev:1)
alert tcp any any -> any any (msg:"remote-kis"; appid:remote-kis; sid:1002289; rev:1)
alert tcp any any -> any any (msg:"remotefs"; appid:remotefs; sid:1002290; rev:1)
alert tcp any any -> any any (msg:"repcmd"; appid:repcmd; sid:1002291; rev:1)
alert tcp any any -> any any (msg:"repscmd"; appid:repscmd; sid:1002292; rev:1)
alert tcp any any -> any any (msg:"rrh"; appid:rrh; sid:1002293; rev:1)
alert tcp any any -> any any (msg:"rlz_dbase"; appid:rlz_dbase; sid:1002294; rev:1)
alert tcp any any -> any any (msg:"rmiregistry"; appid:rmiregistry; sid:1002295; rev:1)
alert tcp any any -> any any (msg:"rmonitor"; appid:rmonitor; sid:1002296; rev:1)
alert tcp any any -> any any (msg:"netvmg-traceroute"; appid:netvmg-traceroute; sid:1002297; rev:1)
alert tcp any any -> any any (msg:"rsvp_tunnel"; appid:rsvp_tunnel; sid:1002298; rev:1)
alert tcp any any -> any any (msg:"rtip"; appid:rtip; sid:1002299; rev:1)
alert tcp any any -> any any (msg:"rushd"; appid:rushd; sid:1002300; rev:1)
alert tcp any any -> any any (msg:"russell_info_sci_calendar_manager"; appid:russell_info_sci_calendar_manager; sid:1002301; rev:1)
alert tcp any any -> any any (msg:"rxe"; appid:rxe; sid:1002302; rev:1)
alert tcp any any -> any any (msg:"sanity"; appid:sanity; sid:1002303; rev:1)
alert tcp any any -> any any (msg:"sap"; appid:sap; sid:1002304; rev:1)
alert tcp any any -> any any (msg:"scc_security"; appid:scc_security; sid:1002305; rev:1)
alert tcp any any -> any any (msg:"sco_desktop_administration_server"; appid:sco_desktop_administration_server; sid:1002306; rev:1)
alert tcp any any -> any any (msg:"sco_system_administration_server"; appid:sco_system_administration_server; sid:1002307; rev:1)
alert tcp any any -> any any (msg:"sco_web_server_manager_3"; appid:sco_web_server_manager_3; sid:1002308; rev:1)
alert tcp any any -> any any (msg:"sco_webserver_manager"; appid:sco_webserver_manager; sid:1002309; rev:1)
alert tcp any any -> any any (msg:"scohelp"; appid:scohelp; sid:1002310; rev:1)
alert tcp any any -> any any (msg:"sst"; appid:sst; sid:1002311; rev:1)
alert tcp any any -> any any (msg:"scx-proxy"; appid:scx-proxy; sid:1002312; rev:1)
alert tcp any any -> any any (msg:"sdns-kmp"; appid:sdns-kmp; sid:1002313; rev:1)
alert tcp any any -> any any (msg:"silc"; appid:silc; sid:1002314; rev:1)
alert tcp any any -> any any (msg:"secure_irc"; appid:secure_irc; sid:1002315; rev:1)
alert tcp any any -> any any (msg:"smid"; appid:smid; sid:1002316; rev:1)
alert tcp any any -> any any (msg:"snntp"; appid:snntp; sid:1002317; rev:1)
alert tcp any any -> any any (msg:"sift"; appid:sift; sid:1002318; rev:1)
alert tcp any any -> any any (msg:"srvloc"; appid:srvloc; sid:1002319; rev:1)
alert tcp any any -> any any (msg:"sflow"; appid:sflow; sid:1002320; rev:1)
alert tcp any any -> any any (msg:"siam"; appid:siam; sid:1002321; rev:1)
alert tcp any any -> any any (msg:"saft"; appid:saft; sid:1002322; rev:1)
alert tcp any any -> any any (msg:"sntp-heartbeat"; appid:sntp-heartbeat; sid:1002323; rev:1)
alert tcp any any -> any any (msg:"sitara_dir"; appid:sitara_dir; sid:1002324; rev:1)
alert tcp any any -> any any (msg:"sitara_management"; appid:sitara_management; sid:1002325; rev:1)
alert tcp any any -> any any (msg:"sitara_server"; appid:sitara_server; sid:1002326; rev:1)
alert tcp any any -> any any (msg:"skronk"; appid:skronk; sid:1002327; rev:1)
alert tcp any any -> any any (msg:"smpnameres"; appid:smpnameres; sid:1002328; rev:1)
alert tcp any any -> any any (msg:"smsd"; appid:smsd; sid:1002329; rev:1)
alert tcp any any -> any any (msg:"softros_lan_messenger"; appid:softros_lan_messenger; sid:1002330; rev:1)
alert tcp any any -> any any (msg:"sonar"; appid:sonar; sid:1002331; rev:1)
alert tcp any any -> any any (msg:"surf"; appid:surf; sid:1002332; rev:1)
alert tcp any any -> any any (msg:"spmp"; appid:spmp; sid:1002333; rev:1)
alert tcp any any -> any any (msg:"spsc"; appid:spsc; sid:1002334; rev:1)
alert tcp any any -> any any (msg:"ss7ns"; appid:ss7ns; sid:1002335; rev:1)
alert tcp any any -> any any (msg:"stmf"; appid:stmf; sid:1002336; rev:1)
alert tcp any any -> any any (msg:"stock_ixchange"; appid:stock_ixchange; sid:1002337; rev:1)
alert tcp any any -> any any (msg:"streettalk"; appid:streettalk; sid:1002338; rev:1)
alert tcp any any -> any any (msg:"stun_over_tls"; appid:stun_over_tls; sid:1002339; rev:1)
alert tcp any any -> any any (msg:"submit_protocol"; appid:submit_protocol; sid:1002340; rev:1)
alert tcp any any -> any any (msg:"subntbcst_tftp"; appid:subntbcst_tftp; sid:1002341; rev:1)
alert tcp any any -> any any (msg:"sun_ipc_server"; appid:sun_ipc_server; sid:1002342; rev:1)
alert tcp any any -> any any (msg:"sundr"; appid:sundr; sid:1002343; rev:1)
alert tcp any any -> any any (msg:"survey_measurement"; appid:survey_measurement; sid:1002344; rev:1)
alert tcp any any -> any any (msg:"srvfp"; appid:srvfp; sid:1002345; rev:1)
alert tcp any any -> any any (msg:"synoptics_snmp_relay"; appid:synoptics_snmp_relay; sid:1002346; rev:1)
alert tcp any any -> any any (msg:"synoptics_trap"; appid:synoptics_trap; sid:1002347; rev:1)
alert tcp any any -> any any (msg:"snare"; appid:snare; sid:1002348; rev:1)
alert tcp any any -> any any (msg:"bb"; appid:bb; sid:1002349; rev:1)
alert tcp any any -> any any (msg:"tdp"; appid:tdp; sid:1002350; rev:1)
alert tcp any any -> any any (msg:"teamsound"; appid:teamsound; sid:1002351; rev:1)
alert tcp any any -> any any (msg:"technical_analysis_software"; appid:technical_analysis_software; sid:1002352; rev:1)
alert tcp any any -> any any (msg:"teedtap"; appid:teedtap; sid:1002353; rev:1)
alert tcp any any -> any any (msg:"tell"; appid:tell; sid:1002354; rev:1)
alert tcp any any -> any any (msg:"tenfold"; appid:tenfold; sid:1002355; rev:1)
alert tcp any any -> any any (msg:"tesla_system_messaging"; appid:tesla_system_messaging; sid:1002356; rev:1)
alert tcp any any -> any any (msg:"tia/eia/is-99_modem_client"; appid:tia/eia/is-99_modem_client; sid:1002357; rev:1)
alert tcp any any -> any any (msg:"tia/eia/is-99_modem_server"; appid:tia/eia/is-99_modem_server; sid:1002358; rev:1)
alert tcp any any -> any any (msg:"timeserver"; appid:timeserver; sid:1002359; rev:1)
alert tcp any any -> any any (msg:"tinc"; appid:tinc; sid:1002360; rev:1)
alert tcp any any -> any any (msg:"tns_cml"; appid:tns_cml; sid:1002361; rev:1)
alert tcp any any -> any any (msg:"tobit_david_replica"; appid:tobit_david_replica; sid:1002362; rev:1)
alert tcp any any -> any any (msg:"tpip"; appid:tpip; sid:1002363; rev:1)
alert tcp any any -> any any (msg:"transport_independent_convergence"; appid:transport_independent_convergence; sid:1002364; rev:1)
alert tcp any any -> any any (msg:"trin00"; appid:trin00; sid:1002365; rev:1)
alert tcp any any -> any any (msg:"ulpnet"; appid:ulpnet; sid:1002366; rev:1)
alert tcp any any -> any any (msg:"unix_time"; appid:unix_time; sid:1002367; rev:1)
alert tcp any any -> any any (msg:"user_location_protocol"; appid:user_location_protocol; sid:1002368; rev:1)
alert tcp any any -> any any (msg:"utmpcd"; appid:utmpcd; sid:1002369; rev:1)
alert tcp any any -> any any (msg:"utmpsd"; appid:utmpsd; sid:1002370; rev:1)
alert tcp any any -> any any (msg:"uuidgen"; appid:uuidgen; sid:1002371; rev:1)
alert tcp any any -> any any (msg:"vacdsm-app"; appid:vacdsm-app; sid:1002372; rev:1)
alert tcp any any -> any any (msg:"vacdsm-sws"; appid:vacdsm-sws; sid:1002373; rev:1)
alert tcp any any -> any any (msg:"vatp"; appid:vatp; sid:1002374; rev:1)
alert tcp any any -> any any (msg:"vemmi"; appid:vemmi; sid:1002375; rev:1)
alert tcp any any -> any any (msg:"vid"; appid:vid; sid:1002376; rev:1)
alert tcp any any -> any any (msg:"videotex"; appid:videotex; sid:1002377; rev:1)
alert tcp any any -> any any (msg:"virtual_presence_protocol"; appid:virtual_presence_protocol; sid:1002378; rev:1)
alert tcp any any -> any any (msg:"vmware_fault_domain_manager"; appid:vmware_fault_domain_manager; sid:1002379; rev:1)
alert tcp any any -> any any (msg:"vnas"; appid:vnas; sid:1002380; rev:1)
alert tcp any any -> any any (msg:"vpps-via"; appid:vpps-via; sid:1002381; rev:1)
alert tcp any any -> any any (msg:"vsinet"; appid:vsinet; sid:1002382; rev:1)
alert tcp any any -> any any (msg:"vvps-qua"; appid:vvps-qua; sid:1002383; rev:1)
alert tcp any any -> any any (msg:"wap_connectionless_session_service"; appid:wap_connectionless_session_service; sid:1002384; rev:1)
alert tcp any any -> any any (msg:"wap_push"; appid:wap_push; sid:1002385; rev:1)
alert tcp any any -> any any (msg:"wap_push_ota_po"; appid:wap_push_ota_po; sid:1002386; rev:1)
alert tcp any any -> any any (msg:"wap_push_ota_se"; appid:wap_push_ota_se; sid:1002387; rev:1)
alert tcp any any -> any any (msg:"wap_push_secure"; appid:wap_push_secure; sid:1002388; rev:1)
alert tcp any any -> any any (msg:"wap_secure_connectionless_session_service"; appid:wap_secure_connectionless_session_service; sid:1002389; rev:1)
alert tcp any any -> any any (msg:"wap_session_sec"; appid:wap_session_sec; sid:1002390; rev:1)
alert tcp any any -> any any (msg:"wap_session_ser"; appid:wap_session_ser; sid:1002391; rev:1)
alert tcp any any -> any any (msg:"wap_vcal"; appid:wap_vcal; sid:1002392; rev:1)
alert tcp any any -> any any (msg:"wap_vcal_secure"; appid:wap_vcal_secure; sid:1002393; rev:1)
alert tcp any any -> any any (msg:"wap_vcard"; appid:wap_vcard; sid:1002394; rev:1)
alert tcp any any -> any any (msg:"wap_vcard_secure"; appid:wap_vcard_secure; sid:1002395; rev:1)
alert tcp any any -> any any (msg:"war-rock"; appid:war-rock; sid:1002396; rev:1)
alert tcp any any -> any any (msg:"whoami"; appid:whoami; sid:1002397; rev:1)
alert tcp any any -> any any (msg:"wlccp"; appid:wlccp; sid:1002398; rev:1)
alert tcp any any -> any any (msg:"world_fusion"; appid:world_fusion; sid:1002399; rev:1)
alert tcp any any -> any any (msg:"wpgs"; appid:wpgs; sid:1002400; rev:1)
alert tcp any any -> any any (msg:"xact-backup"; appid:xact-backup; sid:1002401; rev:1)
alert tcp any any -> any any (msg:"xvttp"; appid:xvttp; sid:1002402; rev:1)
alert tcp any any -> any any (msg:"icmp"; appid:icmp; sid:1002403; rev:1)
alert tcp any any -> any any (msg:"ip_in_ip"; appid:ip_in_ip; sid:1002404; rev:1)
alert tcp any any -> any any (msg:"st"; appid:st; sid:1002405; rev:1)
alert tcp any any -> any any (msg:"cbt"; appid:cbt; sid:1002406; rev:1)
alert tcp any any -> any any (msg:"egp"; appid:egp; sid:1002407; rev:1)
alert tcp any any -> any any (msg:"igrp"; appid:igrp; sid:1002408; rev:1)
alert tcp any any -> any any (msg:"bbn_rcc"; appid:bbn_rcc; sid:1002409; rev:1)
alert tcp any any -> any any (msg:"nvp"; appid:nvp; sid:1002410; rev:1)
alert tcp any any -> any any (msg:"argus"; appid:argus; sid:1002411; rev:1)
alert tcp any any -> any any (msg:"emission_control_protocol"; appid:emission_control_protocol; sid:1002412; rev:1)
alert tcp any any -> any any (msg:"cross_net_debugger"; appid:cross_net_debugger; sid:1002413; rev:1)
alert tcp any any -> any any (msg:"chaosnet"; appid:chaosnet; sid:1002414; rev:1)
alert tcp any any -> any any (msg:"dcn_measurement_subsystems"; appid:dcn_measurement_subsystems; sid:1002415; rev:1)
alert tcp any any -> any any (msg:"hmp"; appid:hmp; sid:1002416; rev:1)
alert tcp any any -> any any (msg:"packet_radio_measurement"; appid:packet_radio_measurement; sid:1002417; rev:1)
alert tcp any any -> any any (msg:"trunk-1_protocol"; appid:trunk-1_protocol; sid:1002418; rev:1)
alert tcp any any -> any any (msg:"trunk-2_protocol"; appid:trunk-2_protocol; sid:1002419; rev:1)
alert tcp any any -> any any (msg:"leaf-1"; appid:leaf-1; sid:1002420; rev:1)
alert tcp any any -> any any (msg:"leaf-2"; appid:leaf-2; sid:1002421; rev:1)
alert tcp any any -> any any (msg:"reliable_datagram_protocol"; appid:reliable_datagram_protocol; sid:1002422; rev:1)
alert tcp any any -> any any (msg:"irtp"; appid:irtp; sid:1002423; rev:1)
alert tcp any any -> any any (msg:"tp4"; appid:tp4; sid:1002424; rev:1)
alert tcp any any -> any any (msg:"netblt"; appid:netblt; sid:1002425; rev:1)
alert tcp any any -> any any (msg:"mfe"; appid:mfe; sid:1002426; rev:1)
alert tcp any any -> any any (msg:"tpcp"; appid:tpcp; sid:1002427; rev:1)
alert tcp any any -> any any (msg:"idpr"; appid:idpr; sid:1002428; rev:1)
alert tcp any any -> any any (msg:"ddp"; appid:ddp; sid:1002429; rev:1)
alert tcp any any -> any any (msg:"idpr_control_message"; appid:idpr_control_message; sid:1002430; rev:1)
alert tcp any any -> any any (msg:"tp++"; appid:tp++; sid:1002431; rev:1)
alert tcp any any -> any any (msg:"il"; appid:il; sid:1002432; rev:1)
alert tcp any any -> any any (msg:"ipv6_encapsulation"; appid:ipv6_encapsulation; sid:1002433; rev:1)
alert tcp any any -> any any (msg:"sdrp"; appid:sdrp; sid:1002434; rev:1)
alert tcp any any -> any any (msg:"idrp"; appid:idrp; sid:1002435; rev:1)
alert tcp any any -> any any (msg:"dsr"; appid:dsr; sid:1002436; rev:1)
alert tcp any any -> any any (msg:"bna"; appid:bna; sid:1002437; rev:1)
alert tcp any any -> any any (msg:"i-nlsp"; appid:i-nlsp; sid:1002438; rev:1)
alert tcp any any -> any any (msg:"swipe"; appid:swipe; sid:1002439; rev:1)
alert tcp any any -> any any (msg:"narp"; appid:narp; sid:1002440; rev:1)
alert tcp any any -> any any (msg:"ip_mobility"; appid:ip_mobility; sid:1002441; rev:1)
alert tcp any any -> any any (msg:"skip"; appid:skip; sid:1002442; rev:1)
alert tcp any any -> any any (msg:"icmp_for_ipv6"; appid:icmp_for_ipv6; sid:1002443; rev:1)
alert tcp any any -> any any (msg:"any host"; appid:any host; sid:1002444; rev:1)
alert tcp any any -> any any (msg:"cftp"; appid:cftp; sid:1002445; rev:1)
alert tcp any any -> any any (msg:"satnet_and_backroom_expak"; appid:satnet_and_backroom_expak; sid:1002446; rev:1)
alert tcp any any -> any any (msg:"rvd"; appid:rvd; sid:1002447; rev:1)
alert tcp any any -> any any (msg:"pluribus_packet_core"; appid:pluribus_packet_core; sid:1002448; rev:1)
alert tcp any any -> any any (msg:"satnet_monitoring"; appid:satnet_monitoring; sid:1002449; rev:1)
alert tcp any any -> any any (msg:"ipcu"; appid:ipcu; sid:1002450; rev:1)
alert tcp any any -> any any (msg:"cp_network_executive"; appid:cp_network_executive; sid:1002451; rev:1)
alert tcp any any -> any any (msg:"cp_heart_beat"; appid:cp_heart_beat; sid:1002452; rev:1)
alert tcp any any -> any any (msg:"wang_span"; appid:wang_span; sid:1002453; rev:1)
alert tcp any any -> any any (msg:"pvp"; appid:pvp; sid:1002454; rev:1)
alert tcp any any -> any any (msg:"satnet"; appid:satnet; sid:1002455; rev:1)
alert tcp any any -> any any (msg:"sun_ndp"; appid:sun_ndp; sid:1002456; rev:1)
alert tcp any any -> any any (msg:"wideband_monitoring"; appid:wideband_monitoring; sid:1002457; rev:1)
alert tcp any any -> any any (msg:"wideband_expak"; appid:wideband_expak; sid:1002458; rev:1)
alert tcp any any -> any any (msg:"vmtp"; appid:vmtp; sid:1002459; rev:1)
alert tcp any any -> any any (msg:"ttp"; appid:ttp; sid:1002460; rev:1)
alert tcp any any -> any any (msg:"nsfnet-igp"; appid:nsfnet-igp; sid:1002461; rev:1)
alert tcp any any -> any any (msg:"tcf"; appid:tcf; sid:1002462; rev:1)
alert tcp any any -> any any (msg:"eigrp"; appid:eigrp; sid:1002463; rev:1)
alert tcp any any -> any any (msg:"ospf"; appid:ospf; sid:1002464; rev:1)
alert tcp any any -> any any (msg:"sprite_rpc"; appid:sprite_rpc; sid:1002465; rev:1)
alert tcp any any -> any any (msg:"locus_arp"; appid:locus_arp; sid:1002466; rev:1)
alert tcp any any -> any any (msg:"mtp"; appid:mtp; sid:1002467; rev:1)
alert tcp any any -> any any (msg:"ax.25"; appid:ax.25; sid:1002468; rev:1)
alert tcp any any -> any any (msg:"micp"; appid:micp; sid:1002469; rev:1)
alert tcp any any -> any any (msg:"semaphore_sec_pro"; appid:semaphore_sec_pro; sid:1002470; rev:1)
alert tcp any any -> any any (msg:"etherip"; appid:etherip; sid:1002471; rev:1)
alert tcp any any -> any any (msg:"encapsulation_header"; appid:encapsulation_header; sid:1002472; rev:1)
alert tcp any any -> any any (msg:"gmtp"; appid:gmtp; sid:1002473; rev:1)
alert tcp any any -> any any (msg:"ifmp"; appid:ifmp; sid:1002474; rev:1)
alert tcp any any -> any any (msg:"pnni"; appid:pnni; sid:1002475; rev:1)
alert tcp any any -> any any (msg:"aris"; appid:aris; sid:1002476; rev:1)
alert tcp any any -> any any (msg:"scps"; appid:scps; sid:1002477; rev:1)
alert tcp any any -> any any (msg:"qnx"; appid:qnx; sid:1002478; rev:1)
alert tcp any any -> any any (msg:"active_networks"; appid:active_networks; sid:1002479; rev:1)
alert tcp any any -> any any (msg:"snp"; appid:snp; sid:1002480; rev:1)
alert tcp any any -> any any (msg:"compaq-peer"; appid:compaq-peer; sid:1002481; rev:1)
alert tcp any any -> any any (msg:"ipx_over_ip"; appid:ipx_over_ip; sid:1002482; rev:1)
alert tcp any any -> any any (msg:"vrrp"; appid:vrrp; sid:1002483; rev:1)
alert tcp any any -> any any (msg:"pgm_rtp"; appid:pgm_rtp; sid:1002484; rev:1)
alert tcp any any -> any any (msg:"d-ii"; appid:d-ii; sid:1002485; rev:1)
alert tcp any any -> any any (msg:"iatp"; appid:iatp; sid:1002486; rev:1)
alert tcp any any -> any any (msg:"schedule_transfer_protocol"; appid:schedule_transfer_protocol; sid:1002487; rev:1)
alert tcp any any -> any any (msg:"srp"; appid:srp; sid:1002488; rev:1)
alert tcp any any -> any any (msg:"uti"; appid:uti; sid:1002489; rev:1)
alert tcp any any -> any any (msg:"smp"; appid:smp; sid:1002490; rev:1)
alert tcp any any -> any any (msg:"sm"; appid:sm; sid:1002491; rev:1)
alert tcp any any -> any any (msg:"ptp"; appid:ptp; sid:1002492; rev:1)
alert tcp any any -> any any (msg:"isis"; appid:isis; sid:1002493; rev:1)
alert tcp any any -> any any (msg:"fire"; appid:fire; sid:1002494; rev:1)
alert tcp any any -> any any (msg:"combat_radio_transport_protocol"; appid:combat_radio_transport_protocol; sid:1002495; rev:1)
alert tcp any any -> any any (msg:"combat_radio_user_datagram"; appid:combat_radio_user_datagram; sid:1002496; rev:1)
alert tcp any any -> any any (msg:"sscopmce"; appid:sscopmce; sid:1002497; rev:1)
alert tcp any any -> any any (msg:"iplt"; appid:iplt; sid:1002498; rev:1)
alert tcp any any -> any any (msg:"sps"; appid:sps; sid:1002499; rev:1)
alert tcp any any -> any any (msg:"pipe"; appid:pipe; sid:1002500; rev:1)
alert tcp any any -> any any (msg:"ifcp"; appid:ifcp; sid:1002501; rev:1)
alert tcp any any -> any any (msg:"rsvp-e2e-ignore"; appid:rsvp-e2e-ignore; sid:1002502; rev:1)
alert tcp any any -> any any (msg:"mpls"; appid:mpls; sid:1002503; rev:1)
alert tcp any any -> any any (msg:"hip"; appid:hip; sid:1002504; rev:1)
alert tcp any any -> any any (msg:"amazon_cloud_drive"; appid:amazon_cloud_drive; sid:1002505; rev:1)
alert tcp any any -> any any (msg:"amazon_cloud_drive_download"; appid:amazon_cloud_drive_download; sid:1002506; rev:1)
alert tcp any any -> any any (msg:"amazon_cloud_drive_upload"; appid:amazon_cloud_drive_upload; sid:1002507; rev:1)
alert tcp any any -> any any (msg:"kik_messenger"; appid:kik_messenger; sid:1002508; rev:1)
alert tcp any any -> any any (msg:"vpnreactor"; appid:vpnreactor; sid:1002509; rev:1)
alert tcp any any -> any any (msg:"cyberghost_vpn"; appid:cyberghost_vpn; sid:1002510; rev:1)
alert tcp any any -> any any (msg:"gre"; appid:gre; sid:1002511; rev:1)
alert tcp any any -> any any (msg:"alipay"; appid:alipay; sid:1002512; rev:1)
alert tcp any any -> any any (msg:"delta_search"; appid:delta_search; sid:1002513; rev:1)
alert tcp any any -> any any (msg:"fluent"; appid:fluent; sid:1002514; rev:1)
alert tcp any any -> any any (msg:"melon"; appid:melon; sid:1002515; rev:1)
alert tcp any any -> any any (msg:"microsoft_store"; appid:microsoft_store; sid:1002516; rev:1)
alert tcp any any -> any any (msg:"news.com.au"; appid:news.com.au; sid:1002517; rev:1)
alert tcp any any -> any any (msg:"soso"; appid:soso; sid:1002518; rev:1)
alert tcp any any -> any any (msg:"woolik"; appid:woolik; sid:1002519; rev:1)
alert tcp any any -> any any (msg:"sina"; appid:sina; sid:1002520; rev:1)
alert tcp any any -> any any (msg:"airsoft_powerburst"; appid:airsoft_powerburst; sid:1002521; rev:1)
alert tcp any any -> any any (msg:"gss_http"; appid:gss_http; sid:1002522; rev:1)
alert tcp any any -> any any (msg:"netwall"; appid:netwall; sid:1002523; rev:1)
alert tcp any any -> any any (msg:"eudora_set"; appid:eudora_set; sid:1002524; rev:1)
alert tcp any any -> any any (msg:"service_status_update"; appid:service_status_update; sid:1002525; rev:1)
alert tcp any any -> any any (msg:"esro-emsdp_v1.3"; appid:esro-emsdp_v1.3; sid:1002526; rev:1)
alert tcp any any -> any any (msg:"olsr"; appid:olsr; sid:1002527; rev:1)
alert tcp any any -> any any (msg:"pkix-3_ca/ra"; appid:pkix-3_ca/ra; sid:1002528; rev:1)
alert tcp any any -> any any (msg:"oracle_remote_data_base"; appid:oracle_remote_data_base; sid:1002529; rev:1)
alert tcp any any -> any any (msg:"iscsi"; appid:iscsi; sid:1002530; rev:1)
alert tcp any any -> any any (msg:"tapeware"; appid:tapeware; sid:1002531; rev:1)
alert tcp any any -> any any (msg:"iax"; appid:iax; sid:1002532; rev:1)
alert tcp any any -> any any (msg:"cvsup"; appid:cvsup; sid:1002533; rev:1)
alert tcp any any -> any any (msg:"msoc_file_transfer"; appid:msoc_file_transfer; sid:1002534; rev:1)
alert tcp any any -> any any (msg:"mcafee_autoupdate"; appid:mcafee_autoupdate; sid:1002535; rev:1)
alert tcp any any -> any any (msg:"amanda"; appid:amanda; sid:1002536; rev:1)
alert tcp any any -> any any (msg:"oracle_business_intelligence"; appid:oracle_business_intelligence; sid:1002537; rev:1)
alert tcp any any -> any any (msg:"webster"; appid:webster; sid:1002538; rev:1)
alert tcp any any -> any any (msg:"tn-tl-fd1"; appid:tn-tl-fd1; sid:1002539; rev:1)
alert tcp any any -> any any (msg:"ggp"; appid:ggp; sid:1002540; rev:1)
alert tcp any any -> any any (msg:"merit_internodal_protocol"; appid:merit_internodal_protocol; sid:1002541; rev:1)
alert tcp any any -> any any (msg:"udp_lite"; appid:udp_lite; sid:1002542; rev:1)
alert tcp any any -> any any (msg:"ad4mat"; appid:ad4mat; sid:1002543; rev:1)
alert tcp any any -> any any (msg:"betclic"; appid:betclic; sid:1002544; rev:1)
alert tcp any any -> any any (msg:"cedexis"; appid:cedexis; sid:1002545; rev:1)
alert tcp any any -> any any (msg:"gg"; appid:gg; sid:1002546; rev:1)
alert tcp any any -> any any (msg:"l'equipe.fr"; appid:l'equipe.fr; sid:1002547; rev:1)
alert tcp any any -> any any (msg:"ligatus"; appid:ligatus; sid:1002548; rev:1)
alert tcp any any -> any any (msg:"line_games"; appid:line_games; sid:1002549; rev:1)
alert tcp any any -> any any (msg:"line_media"; appid:line_media; sid:1002550; rev:1)
alert tcp any any -> any any (msg:"1000mercis"; appid:1000mercis; sid:1002551; rev:1)
alert tcp any any -> any any (msg:"piksel"; appid:piksel; sid:1002552; rev:1)
alert tcp any any -> any any (msg:"proxistore"; appid:proxistore; sid:1002553; rev:1)
alert tcp any any -> any any (msg:"surikate"; appid:surikate; sid:1002554; rev:1)
alert tcp any any -> any any (msg:"viewon"; appid:viewon; sid:1002555; rev:1)
alert tcp any any -> any any (msg:"viewsurf"; appid:viewsurf; sid:1002556; rev:1)
alert tcp any any -> any any (msg:"weborama"; appid:weborama; sid:1002557; rev:1)
alert tcp any any -> any any (msg:"xiti"; appid:xiti; sid:1002558; rev:1)
alert tcp any any -> any any (msg:"zanox"; appid:zanox; sid:1002559; rev:1)
alert tcp any any -> any any (msg:"webex_connect"; appid:webex_connect; sid:1002560; rev:1)
alert tcp any any -> any any (msg:"qq_games"; appid:qq_games; sid:1002561; rev:1)
alert tcp any any -> any any (msg:"easymule"; appid:easymule; sid:1002562; rev:1)
alert tcp any any -> any any (msg:"yik_yak"; appid:yik_yak; sid:1002563; rev:1)
alert tcp any any -> any any (msg:"opendoor"; appid:opendoor; sid:1002564; rev:1)
alert tcp any any -> any any (msg:"onedrive"; appid:onedrive; sid:1002565; rev:1)
alert tcp any any -> any any (msg:"linkedin_contacts"; appid:linkedin_contacts; sid:1002566; rev:1)
alert tcp any any -> any any (msg:"rackspace"; appid:rackspace; sid:1002567; rev:1)
alert tcp any any -> any any (msg:"servicenow"; appid:servicenow; sid:1002568; rev:1)
alert tcp any any -> any any (msg:"t-online"; appid:t-online; sid:1002569; rev:1)
alert tcp any any -> any any (msg:"web.de"; appid:web.de; sid:1002570; rev:1)
alert tcp any any -> any any (msg:"workday"; appid:workday; sid:1002571; rev:1)
alert tcp any any -> any any (msg:"appneta"; appid:appneta; sid:1002572; rev:1)
alert tcp any any -> any any (msg:"blizzard_downloader"; appid:blizzard_downloader; sid:1002573; rev:1)
alert tcp any any -> any any (msg:"blizzard"; appid:blizzard; sid:1002574; rev:1)
alert tcp any any -> any any (msg:"battle.net_site"; appid:battle.net_site; sid:1002575; rev:1)
alert tcp any any -> any any (msg:"pathview"; appid:pathview; sid:1002576; rev:1)
alert tcp any any -> any any (msg:"slingbox_media"; appid:slingbox_media; sid:1002577; rev:1)
alert tcp any any -> any any (msg:"usaip"; appid:usaip; sid:1002578; rev:1)
alert tcp any any -> any any (msg:"yahoo!_douga"; appid:yahoo!_douga; sid:1002579; rev:1)
alert tcp any any -> any any (msg:"yahoo!_box"; appid:yahoo!_box; sid:1002580; rev:1)
alert tcp any any -> any any (msg:"crazy_browser"; appid:crazy_browser; sid:1002581; rev:1)
alert tcp any any -> any any (msg:"greenbrowser"; appid:greenbrowser; sid:1002582; rev:1)
alert tcp any any -> any any (msg:"cometbird"; appid:cometbird; sid:1002583; rev:1)
alert tcp any any -> any any (msg:"flock"; appid:flock; sid:1002584; rev:1)
alert tcp any any -> any any (msg:"arora"; appid:arora; sid:1002585; rev:1)
alert tcp any any -> any any (msg:"fb_notes"; appid:fb_notes; sid:1002586; rev:1)
alert tcp any any -> any any (msg:"browzar"; appid:browzar; sid:1002587; rev:1)
alert tcp any any -> any any (msg:"iec-104"; appid:iec-104; sid:1002588; rev:1)
alert tcp any any -> any any (msg:"clip2net"; appid:clip2net; sid:1002589; rev:1)
alert tcp any any -> any any (msg:"clip2net_upload"; appid:clip2net_upload; sid:1002590; rev:1)
alert tcp any any -> any any (msg:"logmein_rescue"; appid:logmein_rescue; sid:1002591; rev:1)
alert tcp any any -> any any (msg:"mendeley"; appid:mendeley; sid:1002592; rev:1)
alert tcp any any -> any any (msg:"onehub"; appid:onehub; sid:1002593; rev:1)
alert tcp any any -> any any (msg:"zumodrive"; appid:zumodrive; sid:1002594; rev:1)
alert tcp any any -> any any (msg:"efax"; appid:efax; sid:1002595; rev:1)
alert tcp any any -> any any (msg:"yesky"; appid:yesky; sid:1002596; rev:1)
alert tcp any any -> any any (msg:"yahoo!_screen"; appid:yahoo!_screen; sid:1002597; rev:1)
alert tcp any any -> any any (msg:"prime_video"; appid:prime_video; sid:1002598; rev:1)
alert tcp any any -> any any (msg:"playstation_games"; appid:playstation_games; sid:1002599; rev:1)
alert tcp any any -> any any (msg:"tistory"; appid:tistory; sid:1002600; rev:1)
alert tcp any any -> any any (msg:"diodeo"; appid:diodeo; sid:1002601; rev:1)
alert tcp any any -> any any (msg:"egloos"; appid:egloos; sid:1002602; rev:1)
alert tcp any any -> any any (msg:"lineage"; appid:lineage; sid:1002603; rev:1)
alert tcp any any -> any any (msg:"maplestory"; appid:maplestory; sid:1002604; rev:1)
alert tcp any any -> any any (msg:"ezhelp"; appid:ezhelp; sid:1002605; rev:1)
alert tcp any any -> any any (msg:"level_3"; appid:level_3; sid:1002606; rev:1)
alert tcp any any -> any any (msg:"net2phone"; appid:net2phone; sid:1002607; rev:1)
alert tcp any any -> any any (msg:"softether"; appid:softether; sid:1002608; rev:1)
alert tcp any any -> any any (msg:"speedtest_upload"; appid:speedtest_upload; sid:1002609; rev:1)
alert tcp any any -> any any (msg:"channel_4"; appid:channel_4; sid:1002610; rev:1)
alert tcp any any -> any any (msg:"misslee"; appid:misslee; sid:1002611; rev:1)
alert tcp any any -> any any (msg:"qdown"; appid:qdown; sid:1002612; rev:1)
alert tcp any any -> any any (msg:"sbs"; appid:sbs; sid:1002613; rev:1)
alert tcp any any -> any any (msg:"c3_metrics"; appid:c3_metrics; sid:1002614; rev:1)
alert tcp any any -> any any (msg:"leadlander"; appid:leadlander; sid:1002615; rev:1)
alert tcp any any -> any any (msg:"bootstrap_cdn"; appid:bootstrap_cdn; sid:1002616; rev:1)
alert tcp any any -> any any (msg:"gtp_user"; appid:gtp_user; sid:1002617; rev:1)
alert tcp any any -> any any (msg:"ripng"; appid:ripng; sid:1002618; rev:1)
alert tcp any any -> any any (msg:"aurora"; appid:aurora; sid:1002619; rev:1)
alert tcp any any -> any any (msg:"baiduhi"; appid:baiduhi; sid:1002620; rev:1)
alert tcp any any -> any any (msg:"diameter"; appid:diameter; sid:1002621; rev:1)
alert tcp any any -> any any (msg:"igmp"; appid:igmp; sid:1002622; rev:1)
alert tcp any any -> any any (msg:"iso_ip"; appid:iso_ip; sid:1002623; rev:1)
alert tcp any any -> any any (msg:"ad_master"; appid:ad_master; sid:1002624; rev:1)
alert tcp any any -> any any (msg:"ad_tech"; appid:ad_tech; sid:1002625; rev:1)
alert tcp any any -> any any (msg:"gree_games"; appid:gree_games; sid:1002626; rev:1)
alert tcp any any -> any any (msg:"gungho_online_entertainment"; appid:gungho_online_entertainment; sid:1002627; rev:1)
alert tcp any any -> any any (msg:"itv"; appid:itv; sid:1002628; rev:1)
alert tcp any any -> any any (msg:"sharefile_upload_ssl"; appid:sharefile_upload_ssl; sid:1002629; rev:1)
alert tcp any any -> any any (msg:"pim"; appid:pim; sid:1002630; rev:1)
alert tcp any any -> any any (msg:"ipcomp"; appid:ipcomp; sid:1002631; rev:1)
alert tcp any any -> any any (msg:"parc_universal_packet"; appid:parc_universal_packet; sid:1002632; rev:1)
alert tcp any any -> any any (msg:"idp"; appid:idp; sid:1002633; rev:1)
alert tcp any any -> any any (msg:"360_safeguard"; appid:360_safeguard; sid:1002634; rev:1)
alert tcp any any -> any any (msg:"neobux"; appid:neobux; sid:1002635; rev:1)
alert tcp any any -> any any (msg:"people's_daily"; appid:people's_daily; sid:1002636; rev:1)
alert tcp any any -> any any (msg:"kickass_torrents"; appid:kickass_torrents; sid:1002637; rev:1)
alert tcp any any -> any any (msg:"china_daily"; appid:china_daily; sid:1002638; rev:1)
alert tcp any any -> any any (msg:"guangming_online"; appid:guangming_online; sid:1002639; rev:1)
alert tcp any any -> any any (msg:"revenuehits"; appid:revenuehits; sid:1002640; rev:1)
alert tcp any any -> any any (msg:"info.com"; appid:info.com; sid:1002641; rev:1)
alert tcp any any -> any any (msg:"code42"; appid:code42; sid:1002642; rev:1)
alert tcp any any -> any any (msg:"crashplan"; appid:crashplan; sid:1002643; rev:1)
alert tcp any any -> any any (msg:"tencent_cloud"; appid:tencent_cloud; sid:1002644; rev:1)
alert tcp any any -> any any (msg:"qq_mail"; appid:qq_mail; sid:1002645; rev:1)
alert tcp any any -> any any (msg:"qq_pay"; appid:qq_pay; sid:1002646; rev:1)
alert tcp any any -> any any (msg:"gmail_attachment"; appid:gmail_attachment; sid:1002647; rev:1)
alert tcp any any -> any any (msg:"esp"; appid:esp; sid:1002648; rev:1)
alert tcp any any -> any any (msg:"autodesk"; appid:autodesk; sid:1002649; rev:1)
alert tcp any any -> any any (msg:"blackbaud"; appid:blackbaud; sid:1002650; rev:1)
alert tcp any any -> any any (msg:"demandbase"; appid:demandbase; sid:1002651; rev:1)
alert tcp any any -> any any (msg:"intralinks"; appid:intralinks; sid:1002652; rev:1)
alert tcp any any -> any any (msg:"netsuite"; appid:netsuite; sid:1002653; rev:1)
alert tcp any any -> any any (msg:"onavo"; appid:onavo; sid:1002654; rev:1)
alert tcp any any -> any any (msg:"plista"; appid:plista; sid:1002655; rev:1)
alert tcp any any -> any any (msg:"successfactors"; appid:successfactors; sid:1002656; rev:1)
alert tcp any any -> any any (msg:"wow_com"; appid:wow_com; sid:1002657; rev:1)
alert tcp any any -> any any (msg:"webcrawler"; appid:webcrawler; sid:1002658; rev:1)
alert tcp any any -> any any (msg:"adp"; appid:adp; sid:1002659; rev:1)
alert tcp any any -> any any (msg:"adp_globalview"; appid:adp_globalview; sid:1002660; rev:1)
alert tcp any any -> any any (msg:"adp_resource"; appid:adp_resource; sid:1002661; rev:1)
alert tcp any any -> any any (msg:"adp_streamline"; appid:adp_streamline; sid:1002662; rev:1)
alert tcp any any -> any any (msg:"adp_totalsource"; appid:adp_totalsource; sid:1002663; rev:1)
alert tcp any any -> any any (msg:"adp_workforce_now"; appid:adp_workforce_now; sid:1002664; rev:1)
alert tcp any any -> any any (msg:"cerner_corporation"; appid:cerner_corporation; sid:1002665; rev:1)
alert tcp any any -> any any (msg:"conviva"; appid:conviva; sid:1002666; rev:1)
alert tcp any any -> any any (msg:"dealertrack"; appid:dealertrack; sid:1002667; rev:1)
alert tcp any any -> any any (msg:"quickbase"; appid:quickbase; sid:1002668; rev:1)
alert tcp any any -> any any (msg:"quickbooks"; appid:quickbooks; sid:1002669; rev:1)
alert tcp any any -> any any (msg:"turbotax"; appid:turbotax; sid:1002670; rev:1)
alert tcp any any -> any any (msg:"marketo"; appid:marketo; sid:1002671; rev:1)
alert tcp any any -> any any (msg:"qq_music"; appid:qq_music; sid:1002672; rev:1)
alert tcp any any -> any any (msg:"tencent_video"; appid:tencent_video; sid:1002673; rev:1)
alert tcp any any -> any any (msg:"siteimprove"; appid:siteimprove; sid:1002674; rev:1)
alert tcp any any -> any any (msg:"ultimate_software"; appid:ultimate_software; sid:1002675; rev:1)
alert tcp any any -> any any (msg:"hulu_video"; appid:hulu_video; sid:1002676; rev:1)
alert tcp any any -> any any (msg:"mqtt"; appid:mqtt; sid:1002677; rev:1)
alert tcp any any -> any any (msg:"rsvp"; appid:rsvp; sid:1002678; rev:1)
alert tcp any any -> any any (msg:"asana"; appid:asana; sid:1002679; rev:1)
alert tcp any any -> any any (msg:"baydin"; appid:baydin; sid:1002680; rev:1)
alert tcp any any -> any any (msg:"boomerang"; appid:boomerang; sid:1002681; rev:1)
alert tcp any any -> any any (msg:"cloudsponge"; appid:cloudsponge; sid:1002682; rev:1)
alert tcp any any -> any any (msg:"cvent"; appid:cvent; sid:1002683; rev:1)
alert tcp any any -> any any (msg:"docusign"; appid:docusign; sid:1002684; rev:1)
alert tcp any any -> any any (msg:"gantter"; appid:gantter; sid:1002685; rev:1)
alert tcp any any -> any any (msg:"inquest_technologies"; appid:inquest_technologies; sid:1002686; rev:1)
alert tcp any any -> any any (msg:"inspectlet"; appid:inspectlet; sid:1002687; rev:1)
alert tcp any any -> any any (msg:"lucidchart"; appid:lucidchart; sid:1002688; rev:1)
alert tcp any any -> any any (msg:"sliderocket"; appid:sliderocket; sid:1002689; rev:1)
alert tcp any any -> any any (msg:"tripit"; appid:tripit; sid:1002690; rev:1)
alert tcp any any -> any any (msg:"uefa"; appid:uefa; sid:1002691; rev:1)
alert tcp any any -> any any (msg:"warlight"; appid:warlight; sid:1002692; rev:1)
alert tcp any any -> any any (msg:"zomato"; appid:zomato; sid:1002693; rev:1)
alert tcp any any -> any any (msg:"firebase_crashlytics"; appid:firebase_crashlytics; sid:1002694; rev:1)
alert tcp any any -> any any (msg:"flipkart"; appid:flipkart; sid:1002695; rev:1)
alert tcp any any -> any any (msg:"cisco_jabber"; appid:cisco_jabber; sid:1002696; rev:1)
alert tcp any any -> any any (msg:"espncricinfo"; appid:espncricinfo; sid:1002697; rev:1)
alert tcp any any -> any any (msg:"microsoft_visual_studio"; appid:microsoft_visual_studio; sid:1002698; rev:1)
alert tcp any any -> any any (msg:"bluestacks"; appid:bluestacks; sid:1002699; rev:1)
alert tcp any any -> any any (msg:"jetbrains"; appid:jetbrains; sid:1002700; rev:1)
alert tcp any any -> any any (msg:"youdao_dictionary"; appid:youdao_dictionary; sid:1002701; rev:1)
alert tcp any any -> any any (msg:"jetbrains_update"; appid:jetbrains_update; sid:1002702; rev:1)
alert tcp any any -> any any (msg:"jetbrains_plugins"; appid:jetbrains_plugins; sid:1002703; rev:1)
alert tcp any any -> any any (msg:"jetbrains_feature"; appid:jetbrains_feature; sid:1002704; rev:1)
alert tcp any any -> any any (msg:"bluestacks_update"; appid:bluestacks_update; sid:1002705; rev:1)
alert tcp any any -> any any (msg:"bluestacks_download"; appid:bluestacks_download; sid:1002706; rev:1)
alert tcp any any -> any any (msg:"bluestacks_apps"; appid:bluestacks_apps; sid:1002707; rev:1)
alert tcp any any -> any any (msg:"f-secure"; appid:f-secure; sid:1002708; rev:1)
alert tcp any any -> any any (msg:"malwarebytes"; appid:malwarebytes; sid:1002709; rev:1)
alert tcp any any -> any any (msg:"superantispyware"; appid:superantispyware; sid:1002710; rev:1)
alert tcp any any -> any any (msg:"periscope"; appid:periscope; sid:1002711; rev:1)
alert tcp any any -> any any (msg:"zenmate"; appid:zenmate; sid:1002712; rev:1)
alert tcp any any -> any any (msg:"ftp_active"; appid:ftp_active; sid:1002713; rev:1)
alert tcp any any -> any any (msg:"ftp_passive"; appid:ftp_passive; sid:1002714; rev:1)
alert tcp any any -> any any (msg:"eve_online"; appid:eve_online; sid:1002715; rev:1)
alert tcp any any -> any any (msg:"ccp_games"; appid:ccp_games; sid:1002716; rev:1)
alert tcp any any -> any any (msg:"mojang"; appid:mojang; sid:1002717; rev:1)
alert tcp any any -> any any (msg:"wps_office"; appid:wps_office; sid:1002718; rev:1)
alert tcp any any -> any any (msg:"apple_pipeline"; appid:apple_pipeline; sid:1002719; rev:1)
alert tcp any any -> any any (msg:"kontiki"; appid:kontiki; sid:1002720; rev:1)
alert tcp any any -> any any (msg:"brewster"; appid:brewster; sid:1002721; rev:1)
alert tcp any any -> any any (msg:"ea_download_manager"; appid:ea_download_manager; sid:1002722; rev:1)
alert tcp any any -> any any (msg:"joinme"; appid:joinme; sid:1002723; rev:1)
alert tcp any any -> any any (msg:"cloudapp"; appid:cloudapp; sid:1002724; rev:1)
alert tcp any any -> any any (msg:"quic"; appid:quic; sid:1002725; rev:1)
alert tcp any any -> any any (msg:"rapidgator"; appid:rapidgator; sid:1002726; rev:1)
alert tcp any any -> any any (msg:"syncplicity"; appid:syncplicity; sid:1002727; rev:1)
alert tcp any any -> any any (msg:"gom_vpn"; appid:gom_vpn; sid:1002728; rev:1)
alert tcp any any -> any any (msg:"i2p"; appid:i2p; sid:1002729; rev:1)
alert tcp any any -> any any (msg:"jungle_disk"; appid:jungle_disk; sid:1002730; rev:1)
alert tcp any any -> any any (msg:"ninite"; appid:ninite; sid:1002731; rev:1)
alert tcp any any -> any any (msg:"spideroak"; appid:spideroak; sid:1002732; rev:1)
alert tcp any any -> any any (msg:"uploaded"; appid:uploaded; sid:1002733; rev:1)
alert tcp any any -> any any (msg:"wondershare"; appid:wondershare; sid:1002734; rev:1)
alert tcp any any -> any any (msg:"western_digital"; appid:western_digital; sid:1002735; rev:1)
alert tcp any any -> any any (msg:"wd_softwares_download/update"; appid:wd_softwares_download/update; sid:1002736; rev:1)
alert tcp any any -> any any (msg:"hola"; appid:hola; sid:1002737; rev:1)
alert tcp any any -> any any (msg:"baidu_yun"; appid:baidu_yun; sid:1002738; rev:1)
alert tcp any any -> any any (msg:"spinrilla"; appid:spinrilla; sid:1002739; rev:1)
alert tcp any any -> any any (msg:"slack"; appid:slack; sid:1002740; rev:1)
alert tcp any any -> any any (msg:"burnbook"; appid:burnbook; sid:1002741; rev:1)
alert tcp any any -> any any (msg:"skyzip"; appid:skyzip; sid:1002742; rev:1)
alert tcp any any -> any any (msg:"naver_blog"; appid:naver_blog; sid:1002743; rev:1)
alert tcp any any -> any any (msg:"naver_cafe"; appid:naver_cafe; sid:1002744; rev:1)
alert tcp any any -> any any (msg:"daum_blog"; appid:daum_blog; sid:1002745; rev:1)
alert tcp any any -> any any (msg:"daum_cafe"; appid:daum_cafe; sid:1002746; rev:1)
alert tcp any any -> any any (msg:"naver_mail"; appid:naver_mail; sid:1002747; rev:1)
alert tcp any any -> any any (msg:"daum_mail"; appid:daum_mail; sid:1002748; rev:1)
alert tcp any any -> any any (msg:"kakao_story"; appid:kakao_story; sid:1002749; rev:1)
alert tcp any any -> any any (msg:"edge"; appid:edge; sid:1002750; rev:1)
alert tcp any any -> any any (msg:"yandex_appmetrica"; appid:yandex_appmetrica; sid:1002751; rev:1)
alert tcp any any -> any any (msg:"yandex_images"; appid:yandex_images; sid:1002752; rev:1)
alert tcp any any -> any any (msg:"yandex_email"; appid:yandex_email; sid:1002753; rev:1)
alert tcp any any -> any any (msg:"yandex_maps"; appid:yandex_maps; sid:1002754; rev:1)
alert tcp any any -> any any (msg:"yandex_money"; appid:yandex_money; sid:1002755; rev:1)
alert tcp any any -> any any (msg:"yandex_market"; appid:yandex_market; sid:1002756; rev:1)
alert tcp any any -> any any (msg:"yandex_music"; appid:yandex_music; sid:1002757; rev:1)
alert tcp any any -> any any (msg:"yandex_translate"; appid:yandex_translate; sid:1002758; rev:1)
alert tcp any any -> any any (msg:"yandex_video"; appid:yandex_video; sid:1002759; rev:1)
alert tcp any any -> any any (msg:"facebook_like"; appid:facebook_like; sid:1002760; rev:1)
alert tcp any any -> any any (msg:"sway"; appid:sway; sid:1002761; rev:1)
alert tcp any any -> any any (msg:"office_365_planner"; appid:office_365_planner; sid:1002762; rev:1)
alert tcp any any -> any any (msg:"office_mobile"; appid:office_mobile; sid:1002763; rev:1)
alert tcp any any -> any any (msg:"messenger"; appid:messenger; sid:1002764; rev:1)
alert tcp any any -> any any (msg:"psiphon"; appid:psiphon; sid:1002765; rev:1)
alert tcp any any -> any any (msg:"tanium"; appid:tanium; sid:1002766; rev:1)
alert tcp any any -> any any (msg:"fiesta"; appid:fiesta; sid:1002767; rev:1)
alert tcp any any -> any any (msg:"blackbox"; appid:blackbox; sid:1002768; rev:1)
alert tcp any any -> any any (msg:"webex_teams"; appid:webex_teams; sid:1002769; rev:1)
alert tcp any any -> any any (msg:"ms_web_pl_inst"; appid:ms_web_pl_inst; sid:1002770; rev:1)
alert tcp any any -> any any (msg:"yemonisoni"; appid:yemonisoni; sid:1002771; rev:1)
alert tcp any any -> any any (msg:"mopub"; appid:mopub; sid:1002772; rev:1)
alert tcp any any -> any any (msg:"mobilecore"; appid:mobilecore; sid:1002773; rev:1)
alert tcp any any -> any any (msg:"synology_dsm"; appid:synology_dsm; sid:1002774; rev:1)
alert tcp any any -> any any (msg:"livejournal_post"; appid:livejournal_post; sid:1002775; rev:1)
alert tcp any any -> any any (msg:"mail.ru_attachment"; appid:mail.ru_attachment; sid:1002776; rev:1)
alert tcp any any -> any any (msg:"betternet"; appid:betternet; sid:1002777; rev:1)
alert tcp any any -> any any (msg:"boom_beach"; appid:boom_beach; sid:1002778; rev:1)
alert tcp any any -> any any (msg:"browsec"; appid:browsec; sid:1002779; rev:1)
alert tcp any any -> any any (msg:"clash_of_clans"; appid:clash_of_clans; sid:1002780; rev:1)
alert tcp any any -> any any (msg:"frozenway"; appid:frozenway; sid:1002781; rev:1)
alert tcp any any -> any any (msg:"supercell"; appid:supercell; sid:1002782; rev:1)
alert tcp any any -> any any (msg:"clash_royale"; appid:clash_royale; sid:1002783; rev:1)
alert tcp any any -> any any (msg:"cydia"; appid:cydia; sid:1002784; rev:1)
alert tcp any any -> any any (msg:"vpn_master"; appid:vpn_master; sid:1002785; rev:1)
alert tcp any any -> any any (msg:"soundhound"; appid:soundhound; sid:1002786; rev:1)
alert tcp any any -> any any (msg:"anghami"; appid:anghami; sid:1002787; rev:1)
alert tcp any any -> any any (msg:"niantic_labs"; appid:niantic_labs; sid:1002788; rev:1)
alert tcp any any -> any any (msg:"pokemon_go"; appid:pokemon_go; sid:1002789; rev:1)
alert tcp any any -> any any (msg:"zalmos"; appid:zalmos; sid:1002790; rev:1)
alert tcp any any -> any any (msg:"bomgar"; appid:bomgar; sid:1002791; rev:1)
alert tcp any any -> any any (msg:"hello"; appid:hello; sid:1002792; rev:1)
alert tcp any any -> any any (msg:"webm_files"; appid:webm_files; sid:1002793; rev:1)
alert tcp any any -> any any (msg:"rsupport"; appid:rsupport; sid:1002794; rev:1)
alert tcp any any -> any any (msg:"edgecast"; appid:edgecast; sid:1002795; rev:1)
alert tcp any any -> any any (msg:"circuit"; appid:circuit; sid:1002796; rev:1)
alert tcp any any -> any any (msg:"telegram"; appid:telegram; sid:1002797; rev:1)
alert tcp any any -> any any (msg:"aol_games"; appid:aol_games; sid:1002798; rev:1)
alert tcp any any -> any any (msg:"aol_video"; appid:aol_video; sid:1002799; rev:1)
alert tcp any any -> any any (msg:"dgp"; appid:dgp; sid:1002800; rev:1)
alert tcp any any -> any any (msg:"visa"; appid:visa; sid:1002801; rev:1)
alert tcp any any -> any any (msg:"mux"; appid:mux; sid:1002802; rev:1)
alert tcp any any -> any any (msg:"rohc"; appid:rohc; sid:1002803; rev:1)
alert tcp any any -> any any (msg:"svmtp"; appid:svmtp; sid:1002804; rev:1)
alert tcp any any -> any any (msg:"tlsp"; appid:tlsp; sid:1002805; rev:1)
alert tcp any any -> any any (msg:"wesp"; appid:wesp; sid:1002806; rev:1)
alert tcp any any -> any any (msg:"google_g-suite"; appid:google_g-suite; sid:1002807; rev:1)
alert tcp any any -> any any (msg:"google_duo"; appid:google_duo; sid:1002808; rev:1)
alert tcp any any -> any any (msg:"zerovpn"; appid:zerovpn; sid:1002809; rev:1)
alert tcp any any -> any any (msg:"nintendo"; appid:nintendo; sid:1002810; rev:1)
alert tcp any any -> any any (msg:"gothere"; appid:gothere; sid:1002811; rev:1)
alert tcp any any -> any any (msg:"hike"; appid:hike; sid:1002812; rev:1)
alert tcp any any -> any any (msg:"hike_media"; appid:hike_media; sid:1002813; rev:1)
alert tcp any any -> any any (msg:"ngrok"; appid:ngrok; sid:1002814; rev:1)
alert tcp any any -> any any (msg:"paybill"; appid:paybill; sid:1002815; rev:1)
alert tcp any any -> any any (msg:"proxifier"; appid:proxifier; sid:1002816; rev:1)
alert tcp any any -> any any (msg:"uber"; appid:uber; sid:1002817; rev:1)
alert tcp any any -> any any (msg:"cactusvpn"; appid:cactusvpn; sid:1002818; rev:1)
alert tcp any any -> any any (msg:"realvnc"; appid:realvnc; sid:1002819; rev:1)
alert tcp any any -> any any (msg:"elephant_drive"; appid:elephant_drive; sid:1002820; rev:1)
alert tcp any any -> any any (msg:"open_drive"; appid:open_drive; sid:1002821; rev:1)
alert tcp any any -> any any (msg:"anydesk"; appid:anydesk; sid:1002822; rev:1)
alert tcp any any -> any any (msg:"netsarang"; appid:netsarang; sid:1002823; rev:1)
alert tcp any any -> any any (msg:"dds"; appid:dds; sid:1002824; rev:1)
alert tcp any any -> any any (msg:"flightradar24"; appid:flightradar24; sid:1002825; rev:1)
alert tcp any any -> any any (msg:"showbox"; appid:showbox; sid:1002826; rev:1)
alert tcp any any -> any any (msg:"zenvpn"; appid:zenvpn; sid:1002827; rev:1)
alert tcp any any -> any any (msg:"bluejeans"; appid:bluejeans; sid:1002828; rev:1)
alert tcp any any -> any any (msg:"hotstar"; appid:hotstar; sid:1002829; rev:1)
alert tcp any any -> any any (msg:"tiktok"; appid:tiktok; sid:1002830; rev:1)
alert tcp any any -> any any (msg:"azar_live"; appid:azar_live; sid:1002831; rev:1)
alert tcp any any -> any any (msg:"ghaneely"; appid:ghaneely; sid:1002832; rev:1)
alert tcp any any -> any any (msg:"openload"; appid:openload; sid:1002833; rev:1)
alert tcp any any -> any any (msg:"dtls"; appid:dtls; sid:1002834; rev:1)
alert tcp any any -> any any (msg:"dingding"; appid:dingding; sid:1002835; rev:1)
alert tcp any any -> any any (msg:"1fichier"; appid:1fichier; sid:1002836; rev:1)
alert tcp any any -> any any (msg:"9gag"; appid:9gag; sid:1002837; rev:1)
alert tcp any any -> any any (msg:"abs-cbn"; appid:abs-cbn; sid:1002838; rev:1)
alert tcp any any -> any any (msg:"acfun"; appid:acfun; sid:1002839; rev:1)
alert tcp any any -> any any (msg:"ad_redirector"; appid:ad_redirector; sid:1002840; rev:1)
alert tcp any any -> any any (msg:"advanced_hosters"; appid:advanced_hosters; sid:1002841; rev:1)
alert tcp any any -> any any (msg:"albawaba"; appid:albawaba; sid:1002842; rev:1)
alert tcp any any -> any any (msg:"askfm"; appid:askfm; sid:1002843; rev:1)
alert tcp any any -> any any (msg:"asos"; appid:asos; sid:1002844; rev:1)
alert tcp any any -> any any (msg:"avito"; appid:avito; sid:1002845; rev:1)
alert tcp any any -> any any (msg:"azlyrics"; appid:azlyrics; sid:1002846; rev:1)
alert tcp any any -> any any (msg:"babytree"; appid:babytree; sid:1002847; rev:1)
alert tcp any any -> any any (msg:"baike.com"; appid:baike.com; sid:1002848; rev:1)
alert tcp any any -> any any (msg:"beeg"; appid:beeg; sid:1002849; rev:1)
alert tcp any any -> any any (msg:"behance"; appid:behance; sid:1002850; rev:1)
alert tcp any any -> any any (msg:"qatar_airways"; appid:qatar_airways; sid:1002851; rev:1)
alert tcp any any -> any any (msg:"qatar_government"; appid:qatar_government; sid:1002852; rev:1)
alert tcp any any -> any any (msg:"qatar_living"; appid:qatar_living; sid:1002853; rev:1)
alert tcp any any -> any any (msg:"qatar_university"; appid:qatar_university; sid:1002854; rev:1)
alert tcp any any -> any any (msg:"qiita"; appid:qiita; sid:1002855; rev:1)
alert tcp any any -> any any (msg:"qatar_ministry_of_interior"; appid:qatar_ministry_of_interior; sid:1002856; rev:1)
alert tcp any any -> any any (msg:"quizlet"; appid:quizlet; sid:1002857; rev:1)
alert tcp any any -> any any (msg:"rarbg"; appid:rarbg; sid:1002858; rev:1)
alert tcp any any -> any any (msg:"redtube"; appid:redtube; sid:1002859; rev:1)
alert tcp any any -> any any (msg:"reimage"; appid:reimage; sid:1002860; rev:1)
alert tcp any any -> any any (msg:"researchgate"; appid:researchgate; sid:1002861; rev:1)
alert tcp any any -> any any (msg:"russia_today"; appid:russia_today; sid:1002862; rev:1)
alert tcp any any -> any any (msg:"ruten"; appid:ruten; sid:1002863; rev:1)
alert tcp any any -> any any (msg:"rutracker"; appid:rutracker; sid:1002864; rev:1)
alert tcp any any -> any any (msg:"sabah"; appid:sabah; sid:1002865; rev:1)
alert tcp any any -> any any (msg:"sahibinden"; appid:sahibinden; sid:1002866; rev:1)
alert tcp any any -> any any (msg:"savefrom"; appid:savefrom; sid:1002867; rev:1)
alert tcp any any -> any any (msg:"sberbank_of_russia"; appid:sberbank_of_russia; sid:1002868; rev:1)
alert tcp any any -> any any (msg:"state_bank_of_india"; appid:state_bank_of_india; sid:1002869; rev:1)
alert tcp any any -> any any (msg:"sciencedirect"; appid:sciencedirect; sid:1002870; rev:1)
alert tcp any any -> any any (msg:"mama.cn"; appid:mama.cn; sid:1002871; rev:1)
alert tcp any any -> any any (msg:"manorama"; appid:manorama; sid:1002872; rev:1)
alert tcp any any -> any any (msg:"middle_east_broadcasting_center"; appid:middle_east_broadcasting_center; sid:1002873; rev:1)
alert tcp any any -> any any (msg:"medium"; appid:medium; sid:1002874; rev:1)
alert tcp any any -> any any (msg:"mega"; appid:mega; sid:1002875; rev:1)
alert tcp any any -> any any (msg:"merdeka.com"; appid:merdeka.com; sid:1002876; rev:1)
alert tcp any any -> any any (msg:"milliyet"; appid:milliyet; sid:1002877; rev:1)
alert tcp any any -> any any (msg:"myway"; appid:myway; sid:1002878; rev:1)
alert tcp any any -> any any (msg:"nametests"; appid:nametests; sid:1002879; rev:1)
alert tcp any any -> any any (msg:"naukri.com"; appid:naukri.com; sid:1002880; rev:1)
alert tcp any any -> any any (msg:"ndtv"; appid:ndtv; sid:1002881; rev:1)
alert tcp any any -> any any (msg:"nownews"; appid:nownews; sid:1002882; rev:1)
alert tcp any any -> any any (msg:"offerjuice"; appid:offerjuice; sid:1002883; rev:1)
alert tcp any any -> any any (msg:"okezone"; appid:okezone; sid:1002884; rev:1)
alert tcp any any -> any any (msg:"olx.pl"; appid:olx.pl; sid:1002885; rev:1)
alert tcp any any -> any any (msg:"onclick"; appid:onclick; sid:1002886; rev:1)
alert tcp any any -> any any (msg:"onedio"; appid:onedio; sid:1002887; rev:1)
alert tcp any any -> any any (msg:"onet"; appid:onet; sid:1002888; rev:1)
alert tcp any any -> any any (msg:"orange"; appid:orange; sid:1002889; rev:1)
alert tcp any any -> any any (msg:"ouoio.io"; appid:ouoio.io; sid:1002890; rev:1)
alert tcp any any -> any any (msg:"paytm"; appid:paytm; sid:1002891; rev:1)
alert tcp any any -> any any (msg:"pixabay"; appid:pixabay; sid:1002892; rev:1)
alert tcp any any -> any any (msg:"pixiv"; appid:pixiv; sid:1002893; rev:1)
alert tcp any any -> any any (msg:"pixnet"; appid:pixnet; sid:1002894; rev:1)
alert tcp any any -> any any (msg:"popads"; appid:popads; sid:1002895; rev:1)
alert tcp any any -> any any (msg:"popcash"; appid:popcash; sid:1002896; rev:1)
alert tcp any any -> any any (msg:"ppomppu"; appid:ppomppu; sid:1002897; rev:1)
alert tcp any any -> any any (msg:"privatehomeclips"; appid:privatehomeclips; sid:1002898; rev:1)
alert tcp any any -> any any (msg:"bilibili"; appid:bilibili; sid:1002899; rev:1)
alert tcp any any -> any any (msg:"billdesk"; appid:billdesk; sid:1002900; rev:1)
alert tcp any any -> any any (msg:"bitauto"; appid:bitauto; sid:1002901; rev:1)
alert tcp any any -> any any (msg:"blasting_news"; appid:blasting_news; sid:1002902; rev:1)
alert tcp any any -> any any (msg:"blogfa"; appid:blogfa; sid:1002903; rev:1)
alert tcp any any -> any any (msg:"blog.jp"; appid:blog.jp; sid:1002904; rev:1)
alert tcp any any -> any any (msg:"bukalapak"; appid:bukalapak; sid:1002905; rev:1)
alert tcp any any -> any any (msg:"buzzhand"; appid:buzzhand; sid:1002906; rev:1)
alert tcp any any -> any any (msg:"caijing"; appid:caijing; sid:1002907; rev:1)
alert tcp any any -> any any (msg:"cctv.com"; appid:cctv.com; sid:1002908; rev:1)
alert tcp any any -> any any (msg:"ci123"; appid:ci123; sid:1002909; rev:1)
alert tcp any any -> any any (msg:"fingta"; appid:fingta; sid:1002910; rev:1)
alert tcp any any -> any any (msg:"freepik"; appid:freepik; sid:1002911; rev:1)
alert tcp any any -> any any (msg:"friv"; appid:friv; sid:1002912; rev:1)
alert tcp any any -> any any (msg:"gamercom"; appid:gamercom; sid:1002913; rev:1)
alert tcp any any -> any any (msg:"gamersky"; appid:gamersky; sid:1002914; rev:1)
alert tcp any any -> any any (msg:"gearbest"; appid:gearbest; sid:1002915; rev:1)
alert tcp any any -> any any (msg:"gfycat"; appid:gfycat; sid:1002916; rev:1)
alert tcp any any -> any any (msg:"giphy"; appid:giphy; sid:1002917; rev:1)
alert tcp any any -> any any (msg:"gismeteo"; appid:gismeteo; sid:1002918; rev:1)
alert tcp any any -> any any (msg:"globo"; appid:globo; sid:1002919; rev:1)
alert tcp any any -> any any (msg:"gsmarena"; appid:gsmarena; sid:1002920; rev:1)
alert tcp any any -> any any (msg:"gulf_times"; appid:gulf_times; sid:1002921; rev:1)
alert tcp any any -> any any (msg:"haber7"; appid:haber7; sid:1002922; rev:1)
alert tcp any any -> any any (msg:"handycafe"; appid:handycafe; sid:1002923; rev:1)
alert tcp any any -> any any (msg:"hatena_blog"; appid:hatena_blog; sid:1002924; rev:1)
alert tcp any any -> any any (msg:"hdfc_bank"; appid:hdfc_bank; sid:1002925; rev:1)
alert tcp any any -> any any (msg:"h&m"; appid:h&m; sid:1002926; rev:1)
alert tcp any any -> any any (msg:"holacom"; appid:holacom; sid:1002927; rev:1)
alert tcp any any -> any any (msg:"huanqiu"; appid:huanqiu; sid:1002928; rev:1)
alert tcp any any -> any any (msg:"hubspot"; appid:hubspot; sid:1002929; rev:1)
alert tcp any any -> any any (msg:"hurriyet"; appid:hurriyet; sid:1002930; rev:1)
alert tcp any any -> any any (msg:"icici_bank"; appid:icici_bank; sid:1002931; rev:1)
alert tcp any any -> any any (msg:"impresscojp"; appid:impresscojp; sid:1002932; rev:1)
alert tcp any any -> any any (msg:"imzog"; appid:imzog; sid:1002933; rev:1)
alert tcp any any -> any any (msg:"scribol"; appid:scribol; sid:1002934; rev:1)
alert tcp any any -> any any (msg:"seasonvar"; appid:seasonvar; sid:1002935; rev:1)
alert tcp any any -> any any (msg:"seznam"; appid:seznam; sid:1002936; rev:1)
alert tcp any any -> any any (msg:"shopify"; appid:shopify; sid:1002937; rev:1)
alert tcp any any -> any any (msg:"shorte"; appid:shorte; sid:1002938; rev:1)
alert tcp any any -> any any (msg:"siteadvisor"; appid:siteadvisor; sid:1002939; rev:1)
alert tcp any any -> any any (msg:"slither"; appid:slither; sid:1002940; rev:1)
alert tcp any any -> any any (msg:"snapdeal"; appid:snapdeal; sid:1002941; rev:1)
alert tcp any any -> any any (msg:"so.com"; appid:so.com; sid:1002942; rev:1)
alert tcp any any -> any any (msg:"souq"; appid:souq; sid:1002943; rev:1)
alert tcp any any -> any any (msg:"spankbang"; appid:spankbang; sid:1002944; rev:1)
alert tcp any any -> any any (msg:"subscene"; appid:subscene; sid:1002945; rev:1)
alert tcp any any -> any any (msg:"suning"; appid:suning; sid:1002946; rev:1)
alert tcp any any -> any any (msg:"tabelog"; appid:tabelog; sid:1002947; rev:1)
alert tcp any any -> any any (msg:"taboola"; appid:taboola; sid:1002948; rev:1)
alert tcp any any -> any any (msg:"taleo"; appid:taleo; sid:1002949; rev:1)
alert tcp any any -> any any (msg:"teepr"; appid:teepr; sid:1002950; rev:1)
alert tcp any any -> any any (msg:"the_sport_bible"; appid:the_sport_bible; sid:1002951; rev:1)
alert tcp any any -> any any (msg:"tokopedia"; appid:tokopedia; sid:1002952; rev:1)
alert tcp any any -> any any (msg:"trello"; appid:trello; sid:1002953; rev:1)
alert tcp any any -> any any (msg:"tribunnews"; appid:tribunnews; sid:1002954; rev:1)
alert tcp any any -> any any (msg:"ck101"; appid:ck101; sid:1002955; rev:1)
alert tcp any any -> any any (msg:"clicksgear"; appid:clicksgear; sid:1002956; rev:1)
alert tcp any any -> any any (msg:"clip_converter"; appid:clip_converter; sid:1002957; rev:1)
alert tcp any any -> any any (msg:"cnblogs"; appid:cnblogs; sid:1002958; rev:1)
alert tcp any any -> any any (msg:"cnnic"; appid:cnnic; sid:1002959; rev:1)
alert tcp any any -> any any (msg:"cntv"; appid:cntv; sid:1002960; rev:1)
alert tcp any any -> any any (msg:"coc_coc"; appid:coc_coc; sid:1002961; rev:1)
alert tcp any any -> any any (msg:"cricbuzz.com"; appid:cricbuzz.com; sid:1002962; rev:1)
alert tcp any any -> any any (msg:"dainik_bhaskar"; appid:dainik_bhaskar; sid:1002963; rev:1)
alert tcp any any -> any any (msg:"detikcom"; appid:detikcom; sid:1002964; rev:1)
alert tcp any any -> any any (msg:"digikala"; appid:digikala; sid:1002965; rev:1)
alert tcp any any -> any any (msg:"dingit.tv"; appid:dingit.tv; sid:1002966; rev:1)
alert tcp any any -> any any (msg:"diply"; appid:diply; sid:1002967; rev:1)
alert tcp any any -> any any (msg:"directrev"; appid:directrev; sid:1002968; rev:1)
alert tcp any any -> any any (msg:"dmm"; appid:dmm; sid:1002969; rev:1)
alert tcp any any -> any any (msg:"douyu"; appid:douyu; sid:1002970; rev:1)
alert tcp any any -> any any (msg:"eastday"; appid:eastday; sid:1002971; rev:1)
alert tcp any any -> any any (msg:"ekantipur"; appid:ekantipur; sid:1002972; rev:1)
alert tcp any any -> any any (msg:"eksi_sozluk"; appid:eksi_sozluk; sid:1002973; rev:1)
alert tcp any any -> any any (msg:"elmogaz"; appid:elmogaz; sid:1002974; rev:1)
alert tcp any any -> any any (msg:"el_pais"; appid:el_pais; sid:1002975; rev:1)
alert tcp any any -> any any (msg:"ettoday"; appid:ettoday; sid:1002976; rev:1)
alert tcp any any -> any any (msg:"exoclick"; appid:exoclick; sid:1002977; rev:1)
alert tcp any any -> any any (msg:"instructure"; appid:instructure; sid:1002978; rev:1)
alert tcp any any -> any any (msg:"irctc"; appid:irctc; sid:1002979; rev:1)
alert tcp any any -> any any (msg:"island_mob"; appid:island_mob; sid:1002980; rev:1)
alert tcp any any -> any any (msg:"myntra.com"; appid:myntra.com; sid:1002981; rev:1)
alert tcp any any -> any any (msg:"kakaku"; appid:kakaku; sid:1002982; rev:1)
alert tcp any any -> any any (msg:"kapanlagi"; appid:kapanlagi; sid:1002983; rev:1)
alert tcp any any -> any any (msg:"kaskus"; appid:kaskus; sid:1002984; rev:1)
alert tcp any any -> any any (msg:"kinogo"; appid:kinogo; sid:1002985; rev:1)
alert tcp any any -> any any (msg:"kinopoisk"; appid:kinopoisk; sid:1002986; rev:1)
alert tcp any any -> any any (msg:"kissanime"; appid:kissanime; sid:1002987; rev:1)
alert tcp any any -> any any (msg:"kompas.com"; appid:kompas.com; sid:1002988; rev:1)
alert tcp any any -> any any (msg:"the_lad_bible"; appid:the_lad_bible; sid:1002989; rev:1)
alert tcp any any -> any any (msg:"la_repubblica"; appid:la_repubblica; sid:1002990; rev:1)
alert tcp any any -> any any (msg:"libero.it"; appid:libero.it; sid:1002991; rev:1)
alert tcp any any -> any any (msg:"life"; appid:life; sid:1002992; rev:1)
alert tcp any any -> any any (msg:"lifebuzz"; appid:lifebuzz; sid:1002993; rev:1)
alert tcp any any -> any any (msg:"lifehacker"; appid:lifehacker; sid:1002994; rev:1)
alert tcp any any -> any any (msg:"likes"; appid:likes; sid:1002995; rev:1)
alert tcp any any -> any any (msg:"liputan_6"; appid:liputan_6; sid:1002996; rev:1)
alert tcp any any -> any any (msg:"livejasmin"; appid:livejasmin; sid:1002997; rev:1)
alert tcp any any -> any any (msg:"ltn"; appid:ltn; sid:1002998; rev:1)
alert tcp any any -> any any (msg:"udemy"; appid:udemy; sid:1002999; rev:1)
alert tcp any any -> any any (msg:"udn"; appid:udn; sid:1003000; rev:1)
alert tcp any any -> any any (msg:"upornia"; appid:upornia; sid:1003001; rev:1)
alert tcp any any -> any any (msg:"ups.com"; appid:ups.com; sid:1003002; rev:1)
alert tcp any any -> any any (msg:"uptodown"; appid:uptodown; sid:1003003; rev:1)
alert tcp any any -> any any (msg:"upwork"; appid:upwork; sid:1003004; rev:1)
alert tcp any any -> any any (msg:"urdupoint.com"; appid:urdupoint.com; sid:1003005; rev:1)
alert tcp any any -> any any (msg:"varzesh3"; appid:varzesh3; sid:1003006; rev:1)
alert tcp any any -> any any (msg:"the_verge"; appid:the_verge; sid:1003007; rev:1)
alert tcp any any -> any any (msg:"vice"; appid:vice; sid:1003008; rev:1)
alert tcp any any -> any any (msg:"viral_thread"; appid:viral_thread; sid:1003009; rev:1)
alert tcp any any -> any any (msg:"weblio"; appid:weblio; sid:1003010; rev:1)
alert tcp any any -> any any (msg:"webtretho"; appid:webtretho; sid:1003011; rev:1)
alert tcp any any -> any any (msg:"western_journalism"; appid:western_journalism; sid:1003012; rev:1)
alert tcp any any -> any any (msg:"wikihow"; appid:wikihow; sid:1003013; rev:1)
alert tcp any any -> any any (msg:"wirtualna_polska"; appid:wirtualna_polska; sid:1003014; rev:1)
alert tcp any any -> any any (msg:"wix"; appid:wix; sid:1003015; rev:1)
alert tcp any any -> any any (msg:"wowhead"; appid:wowhead; sid:1003016; rev:1)
alert tcp any any -> any any (msg:"xcar"; appid:xcar; sid:1003017; rev:1)
alert tcp any any -> any any (msg:"xfinity"; appid:xfinity; sid:1003018; rev:1)
alert tcp any any -> any any (msg:"xnxx"; appid:xnxx; sid:1003019; rev:1)
alert tcp any any -> any any (msg:"xywycom"; appid:xywycom; sid:1003020; rev:1)
alert tcp any any -> any any (msg:"youm7"; appid:youm7; sid:1003021; rev:1)
alert tcp any any -> any any (msg:"youth.cn"; appid:youth.cn; sid:1003022; rev:1)
alert tcp any any -> any any (msg:"youtubemp3"; appid:youtubemp3; sid:1003023; rev:1)
alert tcp any any -> any any (msg:"google_sign_in"; appid:google_sign_in; sid:1003024; rev:1)
alert tcp any any -> any any (msg:"xiaomi"; appid:xiaomi; sid:1003025; rev:1)
alert tcp any any -> any any (msg:"venmo"; appid:venmo; sid:1003026; rev:1)
alert tcp any any -> any any (msg:"google_inbox"; appid:google_inbox; sid:1003027; rev:1)
alert tcp any any -> any any (msg:"zoom"; appid:zoom; sid:1003028; rev:1)
alert tcp any any -> any any (msg:"uptobox"; appid:uptobox; sid:1003029; rev:1)
alert tcp any any -> any any (msg:"tus_files"; appid:tus_files; sid:1003030; rev:1)
alert tcp any any -> any any (msg:"marine_traffic"; appid:marine_traffic; sid:1003031; rev:1)
alert tcp any any -> any any (msg:"opera_vpn"; appid:opera_vpn; sid:1003032; rev:1)
alert tcp any any -> any any (msg:"power_bi"; appid:power_bi; sid:1003033; rev:1)
alert tcp any any -> any any (msg:"mkru"; appid:mkru; sid:1003034; rev:1)
alert tcp any any -> any any (msg:"mkru_streaming"; appid:mkru_streaming; sid:1003035; rev:1)
alert tcp any any -> any any (msg:"plex_tv"; appid:plex_tv; sid:1003036; rev:1)
alert tcp any any -> any any (msg:"vmware-remote-a"; appid:vmware-remote-a; sid:1003037; rev:1)
alert tcp any any -> any any (msg:"iflix"; appid:iflix; sid:1003038; rev:1)
alert tcp any any -> any any (msg:"u.s_state"; appid:u.s_state; sid:1003039; rev:1)
alert tcp any any -> any any (msg:"azure_cloud_portal"; appid:azure_cloud_portal; sid:1003040; rev:1)
alert tcp any any -> any any (msg:"cimaclub"; appid:cimaclub; sid:1003041; rev:1)
alert tcp any any -> any any (msg:"mathrubhumi"; appid:mathrubhumi; sid:1003042; rev:1)
alert tcp any any -> any any (msg:"mawdoo3"; appid:mawdoo3; sid:1003043; rev:1)
alert tcp any any -> any any (msg:"oman_airways"; appid:oman_airways; sid:1003044; rev:1)
alert tcp any any -> any any (msg:"watan"; appid:watan; sid:1003045; rev:1)
alert tcp any any -> any any (msg:"chrome_webstore"; appid:chrome_webstore; sid:1003046; rev:1)
alert tcp any any -> any any (msg:"office365_admin_portal"; appid:office365_admin_portal; sid:1003047; rev:1)
alert tcp any any -> any any (msg:"windscribe"; appid:windscribe; sid:1003048; rev:1)
alert tcp any any -> any any (msg:"thin-manager"; appid:thin-manager; sid:1003049; rev:1)
alert tcp any any -> any any (msg:"zoho_salesiq_chat"; appid:zoho_salesiq_chat; sid:1003050; rev:1)
alert tcp any any -> any any (msg:"zoho_social"; appid:zoho_social; sid:1003051; rev:1)
alert tcp any any -> any any (msg:"zoho_connect"; appid:zoho_connect; sid:1003052; rev:1)
alert tcp any any -> any any (msg:"zoho_docs"; appid:zoho_docs; sid:1003053; rev:1)
alert tcp any any -> any any (msg:"zoho_assist"; appid:zoho_assist; sid:1003054; rev:1)
alert tcp any any -> any any (msg:"bitcomet"; appid:bitcomet; sid:1003055; rev:1)
alert tcp any any -> any any (msg:"microsoft_stream"; appid:microsoft_stream; sid:1003056; rev:1)
alert tcp any any -> any any (msg:"kaspersky_network_agent"; appid:kaspersky_network_agent; sid:1003057; rev:1)
alert tcp any any -> any any (msg:"elisa_viihde"; appid:elisa_viihde; sid:1003058; rev:1)
alert tcp any any -> any any (msg:"mtv3"; appid:mtv3; sid:1003059; rev:1)
alert tcp any any -> any any (msg:"viaplay"; appid:viaplay; sid:1003060; rev:1)
alert tcp any any -> any any (msg:"yle_areena"; appid:yle_areena; sid:1003061; rev:1)
alert tcp any any -> any any (msg:"lyft"; appid:lyft; sid:1003062; rev:1)
alert tcp any any -> any any (msg:"sony_liv"; appid:sony_liv; sid:1003063; rev:1)
alert tcp any any -> any any (msg:"helpshift"; appid:helpshift; sid:1003064; rev:1)
alert tcp any any -> any any (msg:"edge_chromium"; appid:edge_chromium; sid:1003065; rev:1)
alert tcp any any -> any any (msg:"dls-mon"; appid:dls-mon; sid:1003066; rev:1)
alert tcp any any -> any any (msg:"dn6-nlm-aud"; appid:dn6-nlm-aud; sid:1003067; rev:1)
alert tcp any any -> any any (msg:"emfis-cntl"; appid:emfis-cntl; sid:1003068; rev:1)
alert tcp any any -> any any (msg:"fln-spx"; appid:fln-spx; sid:1003069; rev:1)
alert tcp any any -> any any (msg:"legent-2"; appid:legent-2; sid:1003070; rev:1)
alert tcp any any -> any any (msg:"matip-type-b"; appid:matip-type-b; sid:1003071; rev:1)
alert tcp any any -> any any (msg:"netsc-dev"; appid:netsc-dev; sid:1003072; rev:1)
alert tcp any any -> any any (msg:"orbix-cfg-ssl"; appid:orbix-cfg-ssl; sid:1003073; rev:1)
alert tcp any any -> any any (msg:"sql-net"; appid:sql-net; sid:1003074; rev:1)
alert tcp any any -> any any (msg:"sqlsrv"; appid:sqlsrv; sid:1003075; rev:1)
alert tcp any any -> any any (msg:"uucp-path"; appid:uucp-path; sid:1003076; rev:1)
alert tcp any any -> any any (msg:"uucp-rlogin"; appid:uucp-rlogin; sid:1003077; rev:1)
alert tcp any any -> any any (msg:"ultraview-ccs"; appid:ultraview-ccs; sid:1003078; rev:1)
alert tcp any any -> any any (msg:"prodigy_games"; appid:prodigy_games; sid:1003079; rev:1)
alert tcp any any -> any any (msg:"nelsonnet"; appid:nelsonnet; sid:1003080; rev:1)
alert tcp any any -> any any (msg:"onshape"; appid:onshape; sid:1003081; rev:1)
alert tcp any any -> any any (msg:"noteflight"; appid:noteflight; sid:1003082; rev:1)
alert tcp any any -> any any (msg:"coolmath"; appid:coolmath; sid:1003083; rev:1)
alert tcp any any -> any any (msg:"cloudinary"; appid:cloudinary; sid:1003084; rev:1)
alert tcp any any -> any any (msg:"drift"; appid:drift; sid:1003085; rev:1)
alert tcp any any -> any any (msg:"omron-fins"; appid:omron-fins; sid:1003086; rev:1)
alert tcp any any -> any any (msg:"princess_polly"; appid:princess_polly; sid:1003087; rev:1)
alert tcp any any -> any any (msg:"zscaler"; appid:zscaler; sid:1003088; rev:1)
alert tcp any any -> any any (msg:"stile"; appid:stile; sid:1003089; rev:1)
alert tcp any any -> any any (msg:"catholic_education_australia"; appid:catholic_education_australia; sid:1003090; rev:1)
alert tcp any any -> any any (msg:"font_awesome"; appid:font_awesome; sid:1003091; rev:1)
alert tcp any any -> any any (msg:"firefly_education"; appid:firefly_education; sid:1003092; rev:1)
alert tcp any any -> any any (msg:"grammarly"; appid:grammarly; sid:1003093; rev:1)
alert tcp any any -> any any (msg:"honey"; appid:honey; sid:1003094; rev:1)
alert tcp any any -> any any (msg:"walkme"; appid:walkme; sid:1003095; rev:1)
alert tcp any any -> any any (msg:"workplace_by_facebook"; appid:workplace_by_facebook; sid:1003096; rev:1)
alert tcp any any -> any any (msg:"adobe_fonts"; appid:adobe_fonts; sid:1003097; rev:1)
alert tcp any any -> any any (msg:"amp"; appid:amp; sid:1003098; rev:1)
alert tcp any any -> any any (msg:"tidal"; appid:tidal; sid:1003099; rev:1)
alert tcp any any -> any any (msg:"appier"; appid:appier; sid:1003100; rev:1)
alert tcp any any -> any any (msg:"tappx"; appid:tappx; sid:1003101; rev:1)
alert tcp any any -> any any (msg:"nrdata"; appid:nrdata; sid:1003102; rev:1)
alert tcp any any -> any any (msg:"twinkl"; appid:twinkl; sid:1003103; rev:1)
alert tcp any any -> any any (msg:"zerodha"; appid:zerodha; sid:1003104; rev:1)
alert tcp any any -> any any (msg:"ballina_beach_village"; appid:ballina_beach_village; sid:1003105; rev:1)
alert tcp any any -> any any (msg:"tafe_nsw"; appid:tafe_nsw; sid:1003106; rev:1)
alert tcp any any -> any any (msg:"departapp"; appid:departapp; sid:1003107; rev:1)
alert tcp any any -> any any (msg:"stripe"; appid:stripe; sid:1003108; rev:1)
alert tcp any any -> any any (msg:"dns-over-tls"; appid:dns-over-tls; sid:1003109; rev:1)
alert tcp any any -> any any (msg:"microsoft_teams"; appid:microsoft_teams; sid:1003110; rev:1)
alert tcp any any -> any any (msg:"disney_plus"; appid:disney_plus; sid:1003111; rev:1)
alert tcp any any -> any any (msg:"monster_vpn"; appid:monster_vpn; sid:1003112; rev:1)
alert tcp any any -> any any (msg:"apple_tv_plus"; appid:apple_tv_plus; sid:1003113; rev:1)
alert tcp any any -> any any (msg:"demio"; appid:demio; sid:1003114; rev:1)
alert tcp any any -> any any (msg:"smartsheet"; appid:smartsheet; sid:1003115; rev:1)
alert tcp any any -> any any (msg:"marco_polo"; appid:marco_polo; sid:1003116; rev:1)
alert tcp any any -> any any (msg:"apple_news"; appid:apple_news; sid:1003117; rev:1)
alert tcp any any -> any any (msg:"dns_over_https"; appid:dns_over_https; sid:1003118; rev:1)
alert tcp any any -> any any (msg:"adobe_update"; appid:adobe_update; sid:1003119; rev:1)
alert tcp any any -> any any (msg:"drivehq"; appid:drivehq; sid:1003120; rev:1)
alert tcp any any -> any any (msg:"zoom_upload"; appid:zoom_upload; sid:1003121; rev:1)
alert tcp any any -> any any (msg:"zoom_download"; appid:zoom_download; sid:1003122; rev:1)
alert tcp any any -> any any (msg:"zoom_meeting"; appid:zoom_meeting; sid:1003123; rev:1)
alert tcp any any -> any any (msg:"twilio"; appid:twilio; sid:1003124; rev:1)
alert tcp any any -> any any (msg:"fiserv"; appid:fiserv; sid:1003125; rev:1)
alert tcp any any -> any any (msg:"jaspersoft"; appid:jaspersoft; sid:1003126; rev:1)
alert tcp any any -> any any (msg:"qlikview"; appid:qlikview; sid:1003127; rev:1)
alert tcp any any -> any any (msg:"ringcentral"; appid:ringcentral; sid:1003128; rev:1)
alert tcp any any -> any any (msg:"tableau"; appid:tableau; sid:1003129; rev:1)
alert tcp any any -> any any (msg:"onelogin"; appid:onelogin; sid:1003130; rev:1)
alert tcp any any -> any any (msg:"instagram_media"; appid:instagram_media; sid:1003131; rev:1)
alert tcp any any -> any any (msg:"grpc"; appid:grpc; sid:1003132; rev:1)
alert tcp any any -> any any (msg:"smbv1"; appid:smbv1; sid:1003133; rev:1)
alert tcp any any -> any any (msg:"smbv2"; appid:smbv2; sid:1003134; rev:1)
alert tcp any any -> any any (msg:"smbv3-encrypted"; appid:smbv3-encrypted; sid:1003135; rev:1)
alert tcp any any -> any any (msg:"duo_security"; appid:duo_security; sid:1003136; rev:1)
alert tcp any any -> any any (msg:"firefox_update"; appid:firefox_update; sid:1003137; rev:1)
alert tcp any any -> any any (msg:"waze"; appid:waze; sid:1003138; rev:1)
alert tcp any any -> any any (msg:"vagrant"; appid:vagrant; sid:1003139; rev:1)
alert tcp any any -> any any (msg:"google_meet"; appid:google_meet; sid:1003140; rev:1)
alert tcp any any -> any any (msg:"vocera"; appid:vocera; sid:1003141; rev:1)
alert tcp any any -> any any (msg:"discord"; appid:discord; sid:1003142; rev:1)
alert tcp any any -> any any (msg:"libssh2"; appid:libssh2; sid:1003143; rev:1)
alert tcp any any -> any any (msg:"trilead_ssh-2"; appid:trilead_ssh-2; sid:1003144; rev:1)
alert tcp any any -> any any (msg:"winscp"; appid:winscp; sid:1003145; rev:1)
alert tcp any any -> any any (msg:"mobaxterm"; appid:mobaxterm; sid:1003146; rev:1)
alert tcp any any -> any any (msg:"getscreen.me"; appid:getscreen.me; sid:1003147; rev:1)
alert tcp any any -> any any (msg:"nice"; appid:nice; sid:1003148; rev:1)
alert tcp any any -> any any (msg:"zalo"; appid:zalo; sid:1003149; rev:1)
alert tcp any any -> any any (msg:"wireguard"; appid:wireguard; sid:1003150; rev:1)
alert tcp any any -> any any (msg:"fl-net"; appid:fl-net; sid:1003151; rev:1)
alert tcp any any -> any any (msg:"smbv3-unencrypted"; appid:smbv3-unencrypted; sid:1003152; rev:1)
alert tcp any any -> any any (msg:"pubg"; appid:pubg; sid:1003153; rev:1)
alert tcp any any -> any any (msg:"thousand_eyes"; appid:thousand_eyes; sid:1003154; rev:1)
alert tcp any any -> any any (msg:"logitech"; appid:logitech; sid:1003155; rev:1)
alert tcp any any -> any any (msg:"lenovo"; appid:lenovo; sid:1003156; rev:1)
alert tcp any any -> any any (msg:"ipass"; appid:ipass; sid:1003157; rev:1)
alert tcp any any -> any any (msg:"dameware"; appid:dameware; sid:1003158; rev:1)
alert tcp any any -> any any (msg:"enip"; appid:enip; sid:1003159; rev:1)
alert tcp any any -> any any (msg:"cip"; appid:cip; sid:1003160; rev:1)
alert tcp any any -> any any (msg:"iec_104_single_command"; appid:iec_104_single_command; sid:1003161; rev:1)
alert tcp any any -> any any (msg:"mms_getnamelist"; appid:mms_getnamelist; sid:1003162; rev:1)
alert tcp any any -> any any (msg:"iec_104_control_bitstring_32_bits"; appid:iec_104_control_bitstring_32_bits; sid:1003163; rev:1)
alert tcp any any -> any any (msg:"iec_104_double_command"; appid:iec_104_double_command; sid:1003164; rev:1)
alert tcp any any -> any any (msg:"iec_104_interrogation_command"; appid:iec_104_interrogation_command; sid:1003165; rev:1)
alert tcp any any -> any any (msg:"iec_104_regulating_step_command"; appid:iec_104_regulating_step_command; sid:1003166; rev:1)
alert tcp any any -> any any (msg:"iec_104_setpoint_command_normalized"; appid:iec_104_setpoint_command_normalized; sid:1003167; rev:1)
alert tcp any any -> any any (msg:"iec_104_setpoint_command_scaled"; appid:iec_104_setpoint_command_scaled; sid:1003168; rev:1)
alert tcp any any -> any any (msg:"iec_104_setpoint_command_short_float"; appid:iec_104_setpoint_command_short_float; sid:1003169; rev:1)
alert tcp any any -> any any (msg:"iec_104_end_of_initialization"; appid:iec_104_end_of_initialization; sid:1003170; rev:1)
alert tcp any any -> any any (msg:"iec_104_measured_normalized_with_long_time"; appid:iec_104_measured_normalized_with_long_time; sid:1003171; rev:1)
alert tcp any any -> any any (msg:"iec_104_single_point_info_with_long_time"; appid:iec_104_single_point_info_with_long_time; sid:1003172; rev:1)
alert tcp any any -> any any (msg:"iec_104_step_position_info"; appid:iec_104_step_position_info; sid:1003173; rev:1)
alert tcp any any -> any any (msg:"iec_104_testfr_con"; appid:iec_104_testfr_con; sid:1003174; rev:1)
alert tcp any any -> any any (msg:"iec_104_testfr_act"; appid:iec_104_testfr_act; sid:1003175; rev:1)
alert tcp any any -> any any (msg:"iec_104_startdt_con"; appid:iec_104_startdt_con; sid:1003176; rev:1)
alert tcp any any -> any any (msg:"iec_104_startdt_act"; appid:iec_104_startdt_act; sid:1003177; rev:1)
alert tcp any any -> any any (msg:"iec_104_double_point_info"; appid:iec_104_double_point_info; sid:1003178; rev:1)
alert tcp any any -> any any (msg:"iec_104_monitor_bitstring_32_bit"; appid:iec_104_monitor_bitstring_32_bit; sid:1003179; rev:1)
alert tcp any any -> any any (msg:"iec_104_measured_normalized"; appid:iec_104_measured_normalized; sid:1003180; rev:1)
alert tcp any any -> any any (msg:"iec_104_measured_scaled"; appid:iec_104_measured_scaled; sid:1003181; rev:1)
alert tcp any any -> any any (msg:"iec_104_integrated_totals"; appid:iec_104_integrated_totals; sid:1003182; rev:1)
alert tcp any any -> any any (msg:"iec_104_packed_single_point"; appid:iec_104_packed_single_point; sid:1003183; rev:1)
alert tcp any any -> any any (msg:"iec_104_measured_normalized_without_quality_descriptor"; appid:iec_104_measured_normalized_without_quality_descriptor; sid:1003184; rev:1)
alert tcp any any -> any any (msg:"iec_104_double_point_info_with_long_time"; appid:iec_104_double_point_info_with_long_time; sid:1003185; rev:1)
alert tcp any any -> any any (msg:"iec_104_measured_short_float"; appid:iec_104_measured_short_float; sid:1003186; rev:1)
alert tcp any any -> any any (msg:"iec_104_single_point_info"; appid:iec_104_single_point_info; sid:1003187; rev:1)
alert tcp any any -> any any (msg:"iec_104_step_position_info_with_long_time"; appid:iec_104_step_position_info_with_long_time; sid:1003188; rev:1)
alert tcp any any -> any any (msg:"iec_104_bitstring_32_bit_with_long_time"; appid:iec_104_bitstring_32_bit_with_long_time; sid:1003189; rev:1)
alert tcp any any -> any any (msg:"iec_104_measured_scaled_with_long_time"; appid:iec_104_measured_scaled_with_long_time; sid:1003190; rev:1)
alert tcp any any -> any any (msg:"iec_104_measured_short_float_with_long_time"; appid:iec_104_measured_short_float_with_long_time; sid:1003191; rev:1)
alert tcp any any -> any any (msg:"iec_104_integrated_totals_with_long_time"; appid:iec_104_integrated_totals_with_long_time; sid:1003192; rev:1)
alert tcp any any -> any any (msg:"iec_104_event_of_protection_with_long_time"; appid:iec_104_event_of_protection_with_long_time; sid:1003193; rev:1)
alert tcp any any -> any any (msg:"iec_104_packed_start_event_with_long_time"; appid:iec_104_packed_start_event_with_long_time; sid:1003194; rev:1)
alert tcp any any -> any any (msg:"iec_104_packed_output_circuit_info_with_long_time"; appid:iec_104_packed_output_circuit_info_with_long_time; sid:1003195; rev:1)
alert tcp any any -> any any (msg:"iec_104_single_command_with_long_time"; appid:iec_104_single_command_with_long_time; sid:1003196; rev:1)
alert tcp any any -> any any (msg:"iec_104_double_command_with_long_time"; appid:iec_104_double_command_with_long_time; sid:1003197; rev:1)
alert tcp any any -> any any (msg:"iec_104_regulating_step_command_with_long_time"; appid:iec_104_regulating_step_command_with_long_time; sid:1003198; rev:1)
alert tcp any any -> any any (msg:"iec_104_setpoint_command_normalized_with_long_time"; appid:iec_104_setpoint_command_normalized_with_long_time; sid:1003199; rev:1)
alert tcp any any -> any any (msg:"iec_104_setpoint_command_scaled_with_long_time"; appid:iec_104_setpoint_command_scaled_with_long_time; sid:1003200; rev:1)
alert tcp any any -> any any (msg:"iec_104_setpoint_command_short_float_with_long_time"; appid:iec_104_setpoint_command_short_float_with_long_time; sid:1003201; rev:1)
alert tcp any any -> any any (msg:"iec_104_bitstring_32_bit_command_with_long_time"; appid:iec_104_bitstring_32_bit_command_with_long_time; sid:1003202; rev:1)
alert tcp any any -> any any (msg:"iec_104_counter_interrogation_command"; appid:iec_104_counter_interrogation_command; sid:1003203; rev:1)
alert tcp any any -> any any (msg:"iec_104_read_command"; appid:iec_104_read_command; sid:1003204; rev:1)
alert tcp any any -> any any (msg:"iec_104_clock_synchronization_command"; appid:iec_104_clock_synchronization_command; sid:1003205; rev:1)
alert tcp any any -> any any (msg:"iec_104_reset_process_command"; appid:iec_104_reset_process_command; sid:1003206; rev:1)
alert tcp any any -> any any (msg:"iec_104_test_command_with_long_time"; appid:iec_104_test_command_with_long_time; sid:1003207; rev:1)
alert tcp any any -> any any (msg:"iec_104_parameter_of_measured_normalized"; appid:iec_104_parameter_of_measured_normalized; sid:1003208; rev:1)
alert tcp any any -> any any (msg:"iec_104_parameter_of_measured_scaled"; appid:iec_104_parameter_of_measured_scaled; sid:1003209; rev:1)
alert tcp any any -> any any (msg:"iec_104_parameter_of_measured_short_float"; appid:iec_104_parameter_of_measured_short_float; sid:1003210; rev:1)
alert tcp any any -> any any (msg:"iec_104_parameter_activation"; appid:iec_104_parameter_activation; sid:1003211; rev:1)
alert tcp any any -> any any (msg:"iec_104_file_ready"; appid:iec_104_file_ready; sid:1003212; rev:1)
alert tcp any any -> any any (msg:"iec_104_section_ready"; appid:iec_104_section_ready; sid:1003213; rev:1)
alert tcp any any -> any any (msg:"iec_104_call_directory_select_file"; appid:iec_104_call_directory_select_file; sid:1003214; rev:1)
alert tcp any any -> any any (msg:"iec_104_last_section_last_segment"; appid:iec_104_last_section_last_segment; sid:1003215; rev:1)
alert tcp any any -> any any (msg:"iec_104_ack_file_ack_section"; appid:iec_104_ack_file_ack_section; sid:1003216; rev:1)
alert tcp any any -> any any (msg:"iec_104_list_segment"; appid:iec_104_list_segment; sid:1003217; rev:1)
alert tcp any any -> any any (msg:"iec_104_list_directory"; appid:iec_104_list_directory; sid:1003218; rev:1)
alert tcp any any -> any any (msg:"iec_104_query_log"; appid:iec_104_query_log; sid:1003219; rev:1)
alert tcp any any -> any any (msg:"modbus_read_coils"; appid:modbus_read_coils; sid:1003220; rev:1)
alert tcp any any -> any any (msg:"modbus_read_discrete_inputs"; appid:modbus_read_discrete_inputs; sid:1003221; rev:1)
alert tcp any any -> any any (msg:"modbus_read_holding_registers"; appid:modbus_read_holding_registers; sid:1003222; rev:1)
alert tcp any any -> any any (msg:"modbus_read_input_registers"; appid:modbus_read_input_registers; sid:1003223; rev:1)
alert tcp any any -> any any (msg:"modbus_write_single_coil"; appid:modbus_write_single_coil; sid:1003224; rev:1)
alert tcp any any -> any any (msg:"modbus_write_single_register"; appid:modbus_write_single_register; sid:1003225; rev:1)
alert tcp any any -> any any (msg:"modbus_write_multiple_coils"; appid:modbus_write_multiple_coils; sid:1003226; rev:1)
alert tcp any any -> any any (msg:"modbus_write_multiple_registers"; appid:modbus_write_multiple_registers; sid:1003227; rev:1)
alert tcp any any -> any any (msg:"modbus_read_file_record"; appid:modbus_read_file_record; sid:1003228; rev:1)
alert tcp any any -> any any (msg:"modbus_write_file_record"; appid:modbus_write_file_record; sid:1003229; rev:1)
alert tcp any any -> any any (msg:"modbus_mask_write_register"; appid:modbus_mask_write_register; sid:1003230; rev:1)
alert tcp any any -> any any (msg:"modbus_read/write_multiple_registers"; appid:modbus_read/write_multiple_registers; sid:1003231; rev:1)
alert tcp any any -> any any (msg:"modbus_read_fifo_queue"; appid:modbus_read_fifo_queue; sid:1003232; rev:1)
alert tcp any any -> any any (msg:"modbus_encapsulated_interface_transport"; appid:modbus_encapsulated_interface_transport; sid:1003233; rev:1)
alert tcp any any -> any any (msg:"mms_unconfirmedpdu"; appid:mms_unconfirmedpdu; sid:1003234; rev:1)
alert tcp any any -> any any (msg:"mms_confirmedresponsepdu"; appid:mms_confirmedresponsepdu; sid:1003235; rev:1)
alert tcp any any -> any any (msg:"mms_read"; appid:mms_read; sid:1003236; rev:1)
alert tcp any any -> any any (msg:"mms_write"; appid:mms_write; sid:1003237; rev:1)
alert tcp any any -> any any (msg:"mms_getvariableaccattr"; appid:mms_getvariableaccattr; sid:1003238; rev:1)
alert tcp any any -> any any (msg:"mms_getnamedvariablelistattr"; appid:mms_getnamedvariablelistattr; sid:1003239; rev:1)
alert tcp any any -> any any (msg:"mms_confirmederrorpdu"; appid:mms_confirmederrorpdu; sid:1003240; rev:1)
alert tcp any any -> any any (msg:"mms_status"; appid:mms_status; sid:1003241; rev:1)
alert tcp any any -> any any (msg:"mms_identify"; appid:mms_identify; sid:1003242; rev:1)
alert tcp any any -> any any (msg:"mms_rename"; appid:mms_rename; sid:1003243; rev:1)
alert tcp any any -> any any (msg:"mms_definenamedvariable"; appid:mms_definenamedvariable; sid:1003244; rev:1)
alert tcp any any -> any any (msg:"mms_definescatteredaccess"; appid:mms_definescatteredaccess; sid:1003245; rev:1)
alert tcp any any -> any any (msg:"mms_getscatteredaccessattr"; appid:mms_getscatteredaccessattr; sid:1003246; rev:1)
alert tcp any any -> any any (msg:"mms_deletevariableaccess"; appid:mms_deletevariableaccess; sid:1003247; rev:1)
alert tcp any any -> any any (msg:"mms_definenamedvariablelist"; appid:mms_definenamedvariablelist; sid:1003248; rev:1)
alert tcp any any -> any any (msg:"mms_deletenamedvariablelist"; appid:mms_deletenamedvariablelist; sid:1003249; rev:1)
alert tcp any any -> any any (msg:"mms_definenamedtype"; appid:mms_definenamedtype; sid:1003250; rev:1)
alert tcp any any -> any any (msg:"mms_getnamedtypeattr"; appid:mms_getnamedtypeattr; sid:1003251; rev:1)
alert tcp any any -> any any (msg:"mms_deletenamedtype"; appid:mms_deletenamedtype; sid:1003252; rev:1)
alert tcp any any -> any any (msg:"mms_input"; appid:mms_input; sid:1003253; rev:1)
alert tcp any any -> any any (msg:"mms_output"; appid:mms_output; sid:1003254; rev:1)
alert tcp any any -> any any (msg:"mms_takecontrol"; appid:mms_takecontrol; sid:1003255; rev:1)
alert tcp any any -> any any (msg:"mms_relinquishcontrol"; appid:mms_relinquishcontrol; sid:1003256; rev:1)
alert tcp any any -> any any (msg:"mms_definesemaphore"; appid:mms_definesemaphore; sid:1003257; rev:1)
alert tcp any any -> any any (msg:"mms_deletesemaphore"; appid:mms_deletesemaphore; sid:1003258; rev:1)
alert tcp any any -> any any (msg:"mms_reportsemaphorestatus"; appid:mms_reportsemaphorestatus; sid:1003259; rev:1)
alert tcp any any -> any any (msg:"mms_reportpoolsemaphorestatus"; appid:mms_reportpoolsemaphorestatus; sid:1003260; rev:1)
alert tcp any any -> any any (msg:"mms_reportsemaphoreentrystatus"; appid:mms_reportsemaphoreentrystatus; sid:1003261; rev:1)
alert tcp any any -> any any (msg:"mms_initiatedownloadsequence"; appid:mms_initiatedownloadsequence; sid:1003262; rev:1)
alert tcp any any -> any any (msg:"mms_downloadsegment"; appid:mms_downloadsegment; sid:1003263; rev:1)
alert tcp any any -> any any (msg:"mms_terminatedownloadsequence"; appid:mms_terminatedownloadsequence; sid:1003264; rev:1)
alert tcp any any -> any any (msg:"mms_initiateuploadsequence"; appid:mms_initiateuploadsequence; sid:1003265; rev:1)
alert tcp any any -> any any (msg:"mms_uploadsegment"; appid:mms_uploadsegment; sid:1003266; rev:1)
alert tcp any any -> any any (msg:"mms_terminateuploadsequence"; appid:mms_terminateuploadsequence; sid:1003267; rev:1)
alert tcp any any -> any any (msg:"mms_domaindownload"; appid:mms_domaindownload; sid:1003268; rev:1)
alert tcp any any -> any any (msg:"mms_domainupload"; appid:mms_domainupload; sid:1003269; rev:1)
alert tcp any any -> any any (msg:"mms_loaddomaincontent"; appid:mms_loaddomaincontent; sid:1003270; rev:1)
alert tcp any any -> any any (msg:"mms_storedomaincontent"; appid:mms_storedomaincontent; sid:1003271; rev:1)
alert tcp any any -> any any (msg:"mms_deletedomain"; appid:mms_deletedomain; sid:1003272; rev:1)
alert tcp any any -> any any (msg:"mms_getdomainattributes"; appid:mms_getdomainattributes; sid:1003273; rev:1)
alert tcp any any -> any any (msg:"mms_createprograminvocation"; appid:mms_createprograminvocation; sid:1003274; rev:1)
alert tcp any any -> any any (msg:"mms_deleteprograminvocation"; appid:mms_deleteprograminvocation; sid:1003275; rev:1)
alert tcp any any -> any any (msg:"mms_start"; appid:mms_start; sid:1003276; rev:1)
alert tcp any any -> any any (msg:"mms_stop"; appid:mms_stop; sid:1003277; rev:1)
alert tcp any any -> any any (msg:"mms_resume"; appid:mms_resume; sid:1003278; rev:1)
alert tcp any any -> any any (msg:"mms_reset"; appid:mms_reset; sid:1003279; rev:1)
alert tcp any any -> any any (msg:"mms_kill"; appid:mms_kill; sid:1003280; rev:1)
alert tcp any any -> any any (msg:"mms_getprograminvocationattr"; appid:mms_getprograminvocationattr; sid:1003281; rev:1)
alert tcp any any -> any any (msg:"mms_obtainfile"; appid:mms_obtainfile; sid:1003282; rev:1)
alert tcp any any -> any any (msg:"mms_defineeventcondition"; appid:mms_defineeventcondition; sid:1003283; rev:1)
alert tcp any any -> any any (msg:"mms_deleteeventcondition"; appid:mms_deleteeventcondition; sid:1003284; rev:1)
alert tcp any any -> any any (msg:"mms_geteventconditionattr"; appid:mms_geteventconditionattr; sid:1003285; rev:1)
alert tcp any any -> any any (msg:"mms_reporteventconditionstatus"; appid:mms_reporteventconditionstatus; sid:1003286; rev:1)
alert tcp any any -> any any (msg:"mms_altereventconditionmonitoring"; appid:mms_altereventconditionmonitoring; sid:1003287; rev:1)
alert tcp any any -> any any (msg:"mms_triggerevent"; appid:mms_triggerevent; sid:1003288; rev:1)
alert tcp any any -> any any (msg:"mms_defineeventaction"; appid:mms_defineeventaction; sid:1003289; rev:1)
alert tcp any any -> any any (msg:"mms_deleteeventaction"; appid:mms_deleteeventaction; sid:1003290; rev:1)
alert tcp any any -> any any (msg:"mms_geteventactionattr"; appid:mms_geteventactionattr; sid:1003291; rev:1)
alert tcp any any -> any any (msg:"mms_reporteventactionstatus"; appid:mms_reporteventactionstatus; sid:1003292; rev:1)
alert tcp any any -> any any (msg:"mms_defineeventenrollment"; appid:mms_defineeventenrollment; sid:1003293; rev:1)
alert tcp any any -> any any (msg:"mms_deleteeventenrollment"; appid:mms_deleteeventenrollment; sid:1003294; rev:1)
alert tcp any any -> any any (msg:"mms_altereventenrollment"; appid:mms_altereventenrollment; sid:1003295; rev:1)
alert tcp any any -> any any (msg:"mms_reporteventenrollmentstatus"; appid:mms_reporteventenrollmentstatus; sid:1003296; rev:1)
alert tcp any any -> any any (msg:"mms_geteventenrollmentattr"; appid:mms_geteventenrollmentattr; sid:1003297; rev:1)
alert tcp any any -> any any (msg:"mms_ackeventnotificaton"; appid:mms_ackeventnotificaton; sid:1003298; rev:1)
alert tcp any any -> any any (msg:"mms_getalarmsummary"; appid:mms_getalarmsummary; sid:1003299; rev:1)
alert tcp any any -> any any (msg:"mms_getalarmenrollmentsummary"; appid:mms_getalarmenrollmentsummary; sid:1003300; rev:1)
alert tcp any any -> any any (msg:"mms_readjournal"; appid:mms_readjournal; sid:1003301; rev:1)
alert tcp any any -> any any (msg:"mms_writejournal"; appid:mms_writejournal; sid:1003302; rev:1)
alert tcp any any -> any any (msg:"mms_initializejournal"; appid:mms_initializejournal; sid:1003303; rev:1)
alert tcp any any -> any any (msg:"mms_reportjournalstatus"; appid:mms_reportjournalstatus; sid:1003304; rev:1)
alert tcp any any -> any any (msg:"mms_createjournal"; appid:mms_createjournal; sid:1003305; rev:1)
alert tcp any any -> any any (msg:"mms_deletejournal"; appid:mms_deletejournal; sid:1003306; rev:1)
alert tcp any any -> any any (msg:"mms_getcapabilitylist"; appid:mms_getcapabilitylist; sid:1003307; rev:1)
alert tcp any any -> any any (msg:"mms_fileopen"; appid:mms_fileopen; sid:1003308; rev:1)
alert tcp any any -> any any (msg:"mms_fileread"; appid:mms_fileread; sid:1003309; rev:1)
alert tcp any any -> any any (msg:"mms_fileclose"; appid:mms_fileclose; sid:1003310; rev:1)
alert tcp any any -> any any (msg:"mms_filerename"; appid:mms_filerename; sid:1003311; rev:1)
alert tcp any any -> any any (msg:"mms_filedelete"; appid:mms_filedelete; sid:1003312; rev:1)
alert tcp any any -> any any (msg:"mms_filedirectory"; appid:mms_filedirectory; sid:1003313; rev:1)
alert tcp any any -> any any (msg:"dlms-cosem"; appid:dlms-cosem; sid:1003314; rev:1)
alert tcp any any -> any any (msg:"dlms-cosem_get_response"; appid:dlms-cosem_get_response; sid:1003315; rev:1)
alert tcp any any -> any any (msg:"dlms-cosem_set_response"; appid:dlms-cosem_set_response; sid:1003316; rev:1)
alert tcp any any -> any any (msg:"dlms-cosem_get_request"; appid:dlms-cosem_get_request; sid:1003317; rev:1)
alert tcp any any -> any any (msg:"dlms-cosem_set_request"; appid:dlms-cosem_set_request; sid:1003318; rev:1)
alert tcp any any -> any any (msg:"dlms-cosem_initiate_response"; appid:dlms-cosem_initiate_response; sid:1003319; rev:1)
alert tcp any any -> any any (msg:"dlms-cosem_initiate_request_no_authentication"; appid:dlms-cosem_initiate_request_no_authentication; sid:1003320; rev:1)
alert tcp any any -> any any (msg:"dlms-cosem_initiate_request_low-level_authentication"; appid:dlms-cosem_initiate_request_low-level_authentication; sid:1003321; rev:1)
alert tcp any any -> any any (msg:"dlms-cosem_initiate_request_high-level_authentication"; appid:dlms-cosem_initiate_request_high-level_authentication; sid:1003322; rev:1)
alert tcp any any -> any any (msg:"ieee-c37118"; appid:ieee-c37118; sid:1003323; rev:1)
alert tcp any any -> any any (msg:"ieee_c37.118_header_frame"; appid:ieee_c37.118_header_frame; sid:1003324; rev:1)
alert tcp any any -> any any (msg:"ieee_c37.118_data_frame"; appid:ieee_c37.118_data_frame; sid:1003325; rev:1)
alert tcp any any -> any any (msg:"ieee_c37.118_configuration_frame_1"; appid:ieee_c37.118_configuration_frame_1; sid:1003326; rev:1)
alert tcp any any -> any any (msg:"ieee_c37.118_configuration_frame_2"; appid:ieee_c37.118_configuration_frame_2; sid:1003327; rev:1)
alert tcp any any -> any any (msg:"ieee_c37.118_configuration_frame_3"; appid:ieee_c37.118_configuration_frame_3; sid:1003328; rev:1)
alert tcp any any -> any any (msg:"ieee_c37.118_command_extended_frame"; appid:ieee_c37.118_command_extended_frame; sid:1003329; rev:1)
alert tcp any any -> any any (msg:"ieee_c37.118_command_dt_on_frame"; appid:ieee_c37.118_command_dt_on_frame; sid:1003330; rev:1)
alert tcp any any -> any any (msg:"ieee_c37.118_command_send_header_frame"; appid:ieee_c37.118_command_send_header_frame; sid:1003331; rev:1)
alert tcp any any -> any any (msg:"ieee_c37.118_command_dt_off_frame"; appid:ieee_c37.118_command_dt_off_frame; sid:1003332; rev:1)
alert tcp any any -> any any (msg:"ieee_c37.118_command_send_configuration_2_frame"; appid:ieee_c37.118_command_send_configuration_2_frame; sid:1003333; rev:1)
alert tcp any any -> any any (msg:"ieee_c37.118_command_send_configuration_3_frame"; appid:ieee_c37.118_command_send_configuration_3_frame; sid:1003334; rev:1)
alert tcp any any -> any any (msg:"ieee_c37.118_command_send_configuration_1_frame"; appid:ieee_c37.118_command_send_configuration_1_frame; sid:1003335; rev:1)
alert tcp any any -> any any (msg:"postman"; appid:postman; sid:1003336; rev:1)
alert tcp any any -> any any (msg:"deepl_translator"; appid:deepl_translator; sid:1003337; rev:1)
alert tcp any any -> any any (msg:"notion"; appid:notion; sid:1003338; rev:1)
alert tcp any any -> any any (msg:"grafana"; appid:grafana; sid:1003339; rev:1)
alert tcp any any -> any any (msg:"jabra"; appid:jabra; sid:1003340; rev:1)
alert tcp any any -> any any (msg:"termius"; appid:termius; sid:1003341; rev:1)
alert tcp any any -> any any (msg:"boxcryptor"; appid:boxcryptor; sid:1003342; rev:1)
alert tcp any any -> any any (msg:"wrike"; appid:wrike; sid:1003343; rev:1)
alert tcp any any -> any any (msg:"calendly"; appid:calendly; sid:1003344; rev:1)
alert tcp any any -> any any (msg:"tabnine"; appid:tabnine; sid:1003345; rev:1)
alert tcp any any -> any any (msg:"1password"; appid:1password; sid:1003346; rev:1)
alert tcp any any -> any any (msg:"hop-by-hop_ipv6_extension_header"; appid:hop-by-hop_ipv6_extension_header; sid:1003347; rev:1)
alert tcp any any -> any any (msg:"ipv6_routing_header"; appid:ipv6_routing_header; sid:1003348; rev:1)
alert tcp any any -> any any (msg:"ipv6_frag_header"; appid:ipv6_frag_header; sid:1003349; rev:1)
alert tcp any any -> any any (msg:"ipv6_no_next_header"; appid:ipv6_no_next_header; sid:1003350; rev:1)
alert tcp any any -> any any (msg:"ipv6_destination_options"; appid:ipv6_destination_options; sid:1003351; rev:1)
alert tcp any any -> any any (msg:"tivoli_object_dispatcher"; appid:tivoli_object_dispatcher; sid:1003352; rev:1)
alert tcp any any -> any any (msg:"coap"; appid:coap; sid:1003353; rev:1)
alert tcp any any -> any any (msg:"tradestation"; appid:tradestation; sid:1003354; rev:1)
alert tcp any any -> any any (msg:"dmp"; appid:dmp; sid:1003355; rev:1)
alert tcp any any -> any any (msg:"pearson"; appid:pearson; sid:1003356; rev:1)
alert tcp any any -> any any (msg:"pearson_vue"; appid:pearson_vue; sid:1003357; rev:1)
alert tcp any any -> any any (msg:"pearson_online_academy"; appid:pearson_online_academy; sid:1003358; rev:1)
alert tcp any any -> any any (msg:"savvas"; appid:savvas; sid:1003359; rev:1)
alert tcp any any -> any any (msg:"fandom"; appid:fandom; sid:1003360; rev:1)
alert tcp any any -> any any (msg:"keap"; appid:keap; sid:1003361; rev:1)
alert tcp any any -> any any (msg:"forcepoint"; appid:forcepoint; sid:1003362; rev:1)
alert tcp any any -> any any (msg:"visa.com"; appid:visa.com; sid:1003363; rev:1)
alert tcp any any -> any any (msg:"zoho_crm"; appid:zoho_crm; sid:1003364; rev:1)
alert tcp any any -> any any (msg:"s7commplus"; appid:s7commplus; sid:1003365; rev:1)
alert tcp any any -> any any (msg:"chatgpt"; appid:chatgpt; sid:1003366; rev:1)
alert tcp any any -> any any (msg:"comptia"; appid:comptia; sid:1003367; rev:1)
alert tcp any any -> any any (msg:"openai"; appid:openai; sid:1003368; rev:1)
alert tcp any any -> any any (msg:"dalle"; appid:dalle; sid:1003369; rev:1)
alert tcp any any -> any any (msg:"ola_cabs"; appid:ola_cabs; sid:1003370; rev:1)
alert tcp any any -> any any (msg:"icloud_mail"; appid:icloud_mail; sid:1003371; rev:1)