/*

  Traces two kinds of packet: 1) any http packet, but not to mail.ru; 2) any http packet.
  run like this:
   anettest -d eth0 -r -f this_file.fws

*/

INCLUDE tcp

name "http not to mail"
dstport = 80
dstip != www.mail.ru

   send

name "any http        "
dstip = any

   send
   
   
/*

   Output

      http not to mail : recieved 1839/1, rate    18,  1.26 kB/s (840.3 kB) (sdev 0)
      any http         : recieved 1954/1, rate    18,  1.26 kB/s (855.3 kB) (sdev 0)


*/