A.udp.dstport >=129‖Udp.dstport < =1024&&udp.length ==128B.udp.dstport >=129&&udp.dstport < =1024‖Udp.leng ==128C.udp.dstport >=129&&udp.dstport < =1024&&udp.length eq 128D.udp.port >=129&&udp.port < =1024&&udp.length eq 128
A.tcp.srcport ==80&&tcp.length eq 128B.tcp.srcport ==80&&tcp.len ne 128C.tcp.port ==80&&tcp.length ==128D.tcp.dstport ==80&&tcp.length ==128
A.ftpB.httpC.oicqD.icmp