Suricata

Example

alert enip any any -> any any (msg:"one present frame and one absent"; flow:established,to_server; frame:enip.hdr; bsize:24; frame:enip.cip; bsize: 12; sid:1;)

This behaves the same as

alert enip any any -> any any (msg:"one present frame and one absent"; flow:established,to_server; frame:enip.hdr; bsize:24; sid:1;)

First version could be to refuse to load such a rule
But it would be even better to have it working. Hint : these 2 frames belong to the same transaction