(not tcp and not igrp and not dst port 520 and
((dst port 111) or
(src port 31337) or
(src port 0 or dst port 0) or
(udp[2:2] < 20) or
((port 161 or port 162) and not src net 172.16) or
(udp port 2049) or
((ip[19] = 0xff) and not (net 172.16/16 or net 192.168/16)) or
((ip[19] = 0x00) and not (net 172.16/16 or net 192.168/16)) or
(ip[12:4] = ip[16:4])))
