1*22ab6602Schristospass in exp { "ip.src != 1.1.1.0/24; tcp.dport = 80;" } 2*22ab6602Schristospass in exp { "ip.addr = 1.2.3.4,5.6.7.8;" } 3*22ab6602Schristosblock out exp { "ip.dst= 127.0.0.0/8;" } 4*22ab6602Schristosblock in exp { "udp.sport=53;udp.dport=53;" } 5*22ab6602Schristospass out exp { "tcp.sport=22; tcp.port=25;" } 6