--- /dev/null
+# common block merging, same block elimination, result propogation
+host 192.168.1.1
--- /dev/null
+# common block merging
+port 80
--- /dev/null
+tcp[tcpflags]&tcp-syn != 0 or tcp[tcpflags]&tcp-fin != 0 or tcp[tcpflags]&tcp-rst != 0
--- /dev/null
+# or pullup
+ether[12:2] = 0x800 or ether[12:2] = 0x8100 or ether[0] & 0x80 != 0 or ether[12:2] = 0x9100
--- /dev/null
+vlan 186 and ip
--- /dev/null
+ip and ((icmp and dst host 1.1.1.1 and not host 2.2.2.2) or (host 1.1.1.1 and src host 3.3.3.3))
--- /dev/null
+not vlan and tcp port 80