The rules establish conditions for a match between an IP packet and the filter. To match to the filter, the packet must match at least one rule listed in the filter. To match to the rule, all IP packet headers must be exactly similar to the rule conditions. The rule consists of:

• IP protocol type (e.g., Any IP protocol, TCP, UDP, ICMP and etc)
• Source and destination addresses (e.g., Any address, My computer, A specific IP address and etc)
• Source and destination ports (only for TCP or UDP protocols)
• TOS (Type of Service) field from IP protocol header
• "Mirrored" flag. If mirrored flag is disabled, then IP packet must be exactly similar to the rule and sent bytes counter will be updated only. If mirrored flag is enabled, then rule will also work for IP packets with opposite source and destination addresses and sent & received bytes counter will be updated depending on a direction of IP packets.

Here is the example of the rule below. The sent bytes counter will be updated for TCP packets from hosts 192.168.190.0/255.255.255.0 (any port) to 192.168.4.3 (port 3128). Since "mirrored" flag is on, the received bytes counter will be updated for TCP packets from host 192.168.4.3 (port 3128) to hosts 192.168.190.0/255.255.255.0 (any port).

You can get to the Rule editor from the Filter editor