"Teamviewer" frame matches "teamviewer" || ip.host contains teamviewer || tcp.port==5938 || frame matches "trafficmanager" || ip.host contains trafficmanager ||  frame matches "cloudapp" || ip.host contains cloudapp
"Windows Update Servers" frame matches "download.windowsupdate.com" || frame matches "update.microsoft.com" || frame matches "wustat.windows.com" || frame matches "windowsupdate.microsoft.com" || frame matches "ntservicepack.microsoft.com" || frame matches ".update.microsoft.com" || frame matches ".download.windowsupdate.com" || frame matches ".download.microsoft.com" || frame matches "download.microsoft.com" || frame matches "windowsupdate.com" || frame matches ".windowsupdate.com" || frame matches ".mp.microsoft.com" || frame matches "go.microsoft.com" || frame matches "client.wns.windows.com" || frame matches "mp.microsoft.com" || frame matches "login.live.com"
"Proxy PAC Test" frame matches "(?i)false" || http.request.method=="GET" || http.request.method=="CONNECT" || frame matches "(?i)lync" || frame matches "(?i)autodiscover"
"SYN retransmission" tcp.flags.syn==1 && tcp.analysis.retransmission
"Public IP only" (ip.src==10.0.0.0/8 && !ip.dst==10.0.0.0/8 && !ip.dst==172.16.0.0/12 && !ip.dst==192.168.0.0/16 && !ip.dst==224.0.0.0/4 && !ip.dst==255.255.255.255) || (ip.dst == 10.0.0.0/8 && !ip.src==10.0.0.0/8 && !ip.src==172.16.0.0/12 && !ip.src==192.168.0.0/16)
"Ethernet broadcast" eth.addr == ff:ff:ff:ff:ff:ff
"ACKed Unseen Segment" tcp.analysis.ack_lost_segment
"HTTP Request" http.request.method
"TCP Window low" tcp.window_size < 1000
"1st and 2nd TCP Paket" tcp.flags.syn==1
"2nd and 3rd TCP Paket" (tcp.flags.syn==1 && tcp.flags.ack==1) || (tcp.seq==1 && tcp.ack==1 && tcp.len==0 && tcp.flags.fin==0)
