# DO NOT EDIT THIS FILE!  It was created by Wireshark
@T-TCP HighDelta@tcp.time_delta gt 1 and tcp.flags.reset == 0 and tcp.flags.fin == 0@[46003,0,771][65535,65535,65535]
@T-Bad TCP@tcp.analysis.flags && !tcp.analysis.window_update@[49858,0,0][65535,65535,65535]
@T-ICMP errors@icmp.type in {3 4 5 11} or icmpv6 in {1 2 3 4}@[49858,0,0][65535,65535,65535]
@T-HSRP State Change@hsrp.state != 8 && hsrp.state != 16@[49858,0,0][65535,65535,65535]
@T-Spanning Tree Topology  Change@stp.type == 0x80@[49858,0,0][65535,65535,65535]
@T-OSPF State Change@ospf.msg != 1@[49858,0,0][65535,65535,65535]
@4-TCP RST@tcp.flags.reset eq 1@[59110,59110,59110][0,19789,32896]
@4-TCP SYN@tcp.flags.syn eq 1@[59110,59110,59110][0,19789,32896]
@4-TCP FIN@tcp.flags.fin eq 1@[59110,59110,59110][0,19789,32896]
@4-TCP@tcp@[65535,65535,65535][0,19789,32896]
@4-UDP@udp@[65535,65535,65535][0,19789,32896]
@3-TTL low or unexpected@( ! ip.dst == 224.0.0.0/4 && ip.ttl < 5 && !pim && !ospf) || (ip.dst == 224.0.0.0/24 && ip.dst != 224.0.0.251 && ip.ttl != 1 && !(vrrp || carp))@[65535,65535,65535][12079,37008,18504]
@3-ICMP@icmp || icmpv6@[65535,65535,65535][12079,37008,18504]
@3-Routing@hsrp || eigrp || ospf || bgp || cdp || vrrp || carp || gvrp || igmp || ismp@[65535,65535,65535][12079,37008,18504]
@2-ARP@arp@[65535,65535,65535][65535,27242,0]
@Broadcast@eth[0] & 1@[59110,59110,59110][19532,19532,19532]
