# Bonet-V1
filter="src host 10.0.2.17 and tcp and synack and dst port 25" label="From-Botnet-V1-SPAM"
filter="src host 10.0.2.17 and tcp and synack" label="From-Botnet-V1-TCP-Established"
filter="src host 10.0.2.17 and tcp and syn" label="From-Botnet-V1-TCP-Attempt"
filter="src host 10.0.2.17 and udp and con and dst port 53" label="From-Botnet-V1-DNS"
filter="src host 10.0.2.17 and udp and not con" label="From-Botnet-V1-UDP-Attempt"
filter="src host 10.0.2.17 and udp and con" label="From-Botnet-V1-UDP-Established"

# Bonet-V2
filter="src host 10.0.2.18 and tcp and synack and dst port 25" label="From-Botnet-V2-SPAM"
filter="src host 10.0.2.18 and tcp and synack" label="From-Botnet-V2-TCP-Established"
filter="src host 10.0.2.18 and tcp and syn" label="From-Botnet-V2-TCP-Attempt"
filter="src host 10.0.2.18 and udp and con and dst port 53" label="From-Botnet-V2-DNS"
filter="src host 10.0.2.18 and udp and not con" label="From-Botnet-V2-UDP-Attempt"
filter="src host 10.0.2.18 and udp and con" label="From-Botnet-V2-UDP-Established"

# Bonet-V3
filter="src host 10.0.2.219 and tcp and synack and dst port 25" label="From-Botnet-V3-SPAM"
filter="src host 10.0.2.219 and tcp and synack" label="From-Botnet-V3-TCP-Established"
filter="src host 10.0.2.219 and tcp and syn" label="From-Botnet-V3-TCP-Attempt"
filter="src host 10.0.2.219 and udp and con and dst port 53" label="From-Botnet-V3-DNS"
filter="src host 10.0.2.219 and udp and not con" label="From-Botnet-V3-UDP-Attempt"
filter="src host 10.0.2.219 and udp and con" label="From-Botnet-V3-UDP-Established"

# Background
filter="arp" label="Background-ARP"
filter="" label="Background"
