- IP
ip.addr == xx.xx
ip.src == xx.xx
ip.dst == xx.xx
- port
tcp.port == xx
tcp.dstport == xx
tcp.srcport == xx
- protocol
dns
http
tls
icmp
tcp
udp
- domain
dns.qry.name == xx
ip.addr == xx.xx
ip.src == xx.xx
ip.dst == xx.xx
tcp.port == xx
tcp.dstport == xx
tcp.srcport == xx
dns
http
tls
icmp
tcp
udp
dns.qry.name == xx