# DO NOT EDIT THIS FILE! It was created by Wireshark !@Bad TCP@tcp.analysis.flags@[0,0,0][65535,24383,24383] @HSRP State Change@hsrp.state != 8 && hsrp.state != 16@[0,0,0][65535,63222,0] @Spanning Tree Topology Change@stp.type == 0x80@[0,0,0][65535,63222,0] @OSPF State Change@ospf.msg != 1@[0,0,0][65535,63222,0] @ICMP errors@icmp.type eq 3 || icmp.type eq 4 || icmp.type eq 5 || icmp.type eq 11@[0,0,0][0,65535,3616] @ARP@arp@[55011,59486,65534][0,0,0] @ICMP@icmp || icmpv6@[49680,49737,65535][0,0,0] @TCP RST@tcp.flags.reset eq 1@[37008,0,0][65535,63121,32911] @TTL low or unexpected@( ! ip.dst == 224.0.0.0/4 && ip.ttl < 5 && !pim) || (ip.dst == 224.0.0.0/24 && ip.ttl != 1)@[37008,0,0][65535,65535,65535] !@Checksum Errors@cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1 || mstp.checksum_bad==1@[0,0,0][65535,24383,24383] @DCERPC@dcerpc@[51199,38706,65533][0,0,0] @Routing@hsrp || eigrp || ospf || bgp || cdp || vrrp || gvrp || igmp || ismp@[65534,62325,54808][0,0,0] @SMB@smb || nbss || nbns || nbipx || ipxsap || netbios@[65535,65535,65535][2986,35797,6846] @Broadcast@eth[0] & 1@[65535,65535,65535][32768,32768,32768] @HTTP@http || tcp.port == 80@[38888,64704,35803][0,0,0] @TCP Retransmissions@tcp.analysis.retransmission || tcp.analysis.lost_segment || tcp.analysis.out_of_order@[65535,65535,65535][65534,5782,5782] @Serverbusy@ncp.type == 0x9999@[50668,64033,50017][65534,4786,6682] @NCP Errors@ncp.completion_code != 0@[65535,65535,65535][65534,8649,7701] @NDS Errors@ncp.ndsreplyerror != 0@[65535,65535,65535][65534,4818,4818] @NDPS Errors@ndps.error_val != 0x0 || ndps.rpc_acc_stat != 0x0 || ndps.ret_code != 0x0@[65535,65535,65535][65534,3831,2883] @NMAS Errors@nmas.return_code != 0 || nmas.encrypt_error != 0@[65535,65535,39321][62059,7301,7301] @SecretStore Errors@sss.return_code != 0@[65535,65535,65535][64542,881,3684] @NFS Error@nfs.status!=0@[65535,65535,65535][62579,9098,1892] @Kerberos Errors@kerberos.error_code != 0@[65535,65535,39321][59770,5765,5765] @ExtendedAttributeErrors@ncp.ea_error_codes != 0@[65535,65535,65535][61451,2112,8705] @Srvloc Errors@srvloc.errv2 != 0 || srvloc.err != 0@[65535,65535,65535][64018,1517,1517] @DNS Errors@dns.flags.rcode != 0@[65535,65535,39321][61141,2280,2280] @Spanning Tree Topology Change@stp.flags.tc != 0@[65535,65535,65535][63255,4394,4394] @SMB Errors@smb.error_code != 0 || smb.nt_status != 0@[65535,65535,39321][62873,5833,5833] @NDPS Packets@ndps@[65535,65535,65535][21646,3693,40511] @SPX Packets@spx@[65535,65535,65535][0,0,0] @LIP Packets@ncp.type == 0x4c69 || ncp.type == 0x1111@[65535,65535,65535][52626,48616,3987] @NDS Packets@ncp.func==0x68@[65535,65535,65535][39340,6551,51633] @NMAS Packets@ncp.func == 0x5e@[65535,65535,65535][12243,36571,40711] @SecretStore@ncp.func == 0x5c@[65535,65535,65535][60073,11512,35117] @NCP Packets@ncp@[65535,65535,65535][60073,8304,56386] @RIP / SAP Packets@ipxrip || ipxsap@[65535,65535,65535][9765,41704,6849] @LDAP Packets@ldap@[65535,65535,65535][63549,38799,34180] @SLP Packets@srvloc@[65535,65535,65535][17595,21522,52130] @TCP Packets@tcp@[65535,65535,65535][45675,43802,18102] @DHCP Packets@bootp@[65535,65535,65535][17662,50144,48692] @ARP Packets@arp@[65535,65535,65535][54116,33043,9120] @DNS Packets@dns@[65535,65535,65535][38433,47661,19785] @NDPS Packets@ndps@[65535,65535,65535][21646,3693,40511] @SPX Packets@spx@[65535,65535,65535][0,0,0] @IPX@ipx || spx@[65534,58325,58808][0,0,0] @Retransmit@tcp.analysis.retransmission@[29511,4371,16334][57882,61197,22356] @Duplicate ack@tcp.analysis.duplicate_ack@[43812,2565,16638][62381,46515,23742] @TCP SYN/FIN@tcp.flags & 0x02 || tcp.flags.fin == 1@[41026,41026,41026][0,0,0] @TCP@tcp@[59345,58980,65534][0,0,0] @UDP@udp@[28834,57427,65533][0,0,0]