3 Action=PduDef; Name=tcp_pdu; Proto=tcp; Transport=ip; addr=ip.addr; port=tcp.port; tcp_start=tcp.flags.syn; tcp_stop=tcp.flags.fin; tcp_stop=tcp.flags.reset;
4 Action=GopDef; Name=tcp_session; On=tcp_pdu; addr; addr; port; port;
5 Action=GopStart; For=tcp_session; tcp_start=1;
6 Action=GopStop; For=tcp_session; tcp_stop=1;