# DO NOT EDIT THIS FILE!  It was created by Wireshark
@MySQL Error@mysql.error_code> 0@[65535,65535,65535][65278,0,0]
@Frame contains Comment@frame.comment@[65535,65535,65535][0,39321,21331]
@Executable Header@frame contains 54:68:69:73:20:70:72:6f:67:72:61:6d:20:63:61:6e:6e:6f:74:20:62:65:20:72:75:6e:20:69:6e:20:44:4f:53:20:6d:6f:64:65:2e:0d@[65535,65535,65535][65535,17990,0]
@SIP Methods@sip.Method@[65535,65535,65535][21074,38293,65278]
@SIP Error@sip.Status-Code >= 500@[65535,65535,65535][65535,0,0]
@SIP Warnings@sip.Status-Code >= 400@[65535,65535,65535][65535,44975,0]
@SIP Status Okay@sip.Status-Code < 400@[65535,65535,65535][6425,41891,0]
@4 NOP Problem@tcp.options contains 01:01:01:01@[65535,65535,65535][65535,0,0]
@Invalid TCP packets@(tcp.flags.syn==1 and tcp.window_size == 0)@[65535,65535,65535][65535,0,0]
@TCP Duplicate ACK@tcp.analysis.duplicate_ack@[65535,65535,65535][65535,28270,6682]
@TCP Expert Warning@tcp.analysis.flags and not (tcp.analysis.keep_alive or tcp.analysis.keep_alive_ack or tcp.analysis.window_update)@[65535,65535,65535][64764,8224,15934]
@TCP Window Critical@(tcp.window_size < 1460) and not (tcp.flags.syn==1 or tcp.flags.reset==1 or tcp.window_size_scalefactor == -1)@[65535,65535,65535][57825,0,34952]
!@TCP without Don't Fragment Flag@tcp and ip.flags.df == 0@[65535,65535,65535][65535,20817,0]
@TCP Keep Alive@tcp.analysis.keep_alive or tcp.analysis.keep_alive_ack or tcp.analysis.window_update@[65535,65535,65535][38036,9252,52428]
@ICMP Warnings@(icmp and ((icmp.type > 0) and (icmp.type < 8) or icmp.type > 8)) or (icmpv6 and icmpv6.type < 128)@[65535,65535,65535][65535,21074,0]
@SYN Flag only@tcp.flags.syn==1 and not tcp.flags.ack==1@[65535,65535,65535][8738,34181,7196]
@TCP Teardown@(tcp.flags.fin==1)@[65535,65535,65535][8995,35209,31354]
@TCP Reset@tcp.flags.reset==1@[65535,65535,65535][65535,28270,0]
@IPv4 header with options@ip.hdr_len > 20@[65535,65535,65535][65535,46003,1799]
@DNS - Many Answer records@dns.count.answers > 5@[65535,65535,65535][65535,23901,0]
@Spanning Tree Topology Change@stp.flags.tc==1@[65535,65535,65535][53970,37522,2056]
@SMB Lock not granted@smb.nt_status == 0xc0000055@[65535,65535,65535][42148,27242,10280]
@HTTP Server Response Code>=  400@http.response.code >= 400 and not http.response.code==404@[65535,65535,65535][61166,6425,6425]
@FTP Response Code >= 400@ftp.response.code >= 400@[65535,65535,65535][65535,0,0]
@IPv6 Router Advertisement@icmpv6.type == 134@[65535,65535,65535][14906,40606,1285]
@ICMPv6 Trouble (Redirect)@icmpv6.type == 137@[65535,65535,65535][65535,30069,1285]
@IPv6 Solicitation Messages@icmpv6.type > 133 and icmpv6.type < 137@[65535,65535,65535][1028,26214,42662]
@Ping@icmp.type==0 or icmp.type==8 or icmpv6.type == 128 or icmpv6.type == 129@[65535,65535,65535][0,16448,65535]
@ARP Trouble@arp.dst.proto_ipv4 == 255.255.255.255@[65535,65535,65535][65535,0,0]
@Special ARP@eth.type==0x8035 or arp.isgratuitous==1@[65535,65535,65535][34695,0,46774]
@Name Resolution Critical@(dns and (dns.flags.response == 1)) and (dns.flags.rcode==2 or dns.flags.rcode==5)@[65535,65535,65535][65535,0,0]
@Name Resolution Warning@(dns and (dns.flags.response == 1)) and (dns.flags.rcode == 3)@[65535,65535,65535][65535,44975,0]
@Name Resolutions@dns or nbns@[65535,65535,65535][10794,41891,39321]
@Citrix@tcp.port==1494 or tcp.port==2598@[65535,65535,65535][9509,34695,48059]
@SMTP Error@smtp.response.code >= 500@[65535,65535,65535][65535,0,0]
@SMTP Warning@smtp.response.code >= 400@[65535,65535,65535][65535,36494,1285]
@Infracstructure Protocols@ospf or hsrp or cdp or igmp or slow@[65535,65535,65535][37522,31868,60395]
@Syslog@syslog@[65535,65535,65535][3341,36237,56026]
@IPv6 Router Solicitation and Advertisement@icmpv6.type == 133 or icmpv6.type==134@[65535,65535,65535][65535,43176,0]
@DHCPv4@bootp@[65535,65535,65535][514,36494,55769]
@ESP@esp@[65535,65535,65535][24672,2313,0]