!impostor and !loopback and
 (outbound and
  ((ip and
    udp.DstPort>=50000 and udp.DstPort<=50099 and
    udp.PayloadLength=74 and
    udp.Payload32[0]=0x00010046 and
    udp.Payload32[2]=0 and
    udp.Payload32[3]=0 and
    udp.Payload32[4]=0 and
    udp.Payload32[5]=0 and
    udp.Payload32[6]=0 and
    udp.Payload32[7]=0 and
    udp.Payload32[8]=0 and
    udp.Payload32[9]=0 and
    udp.Payload32[10]=0 and
    udp.Payload32[11]=0 and
    udp.Payload32[12]=0 and
    udp.Payload32[13]=0 and
    udp.Payload32[14]=0 and
    udp.Payload32[15]=0 and
    udp.Payload32[16]=0 and
    udp.Payload32[17]=0)
   or
   (udp.PayloadLength>=20 and
    udp.Payload32[1]=0x2112A442 and udp.Payload[0]<0x40) or ((tcp.DstPort == 80) or (tcp.DstPort == 443) or (udp.DstPort == 443))) and
  ( ((ip.DstAddr < 127.0.0.1 or ip.DstAddr > 127.255.255.255) and (ip.DstAddr < 10.0.0.0 or ip.DstAddr > 10.255.255.255) and (ip.DstAddr < 192.168.0.0 or ip.DstAddr > 192.168.255.255) and (ip.DstAddr < 172.16.0.0 or ip.DstAddr > 172.31.255.255) and (ip.DstAddr < 169.254.0.0 or ip.DstAddr > 169.254.255.255)) or
     ((ipv6.DstAddr > ::1) and (ipv6.DstAddr < 2001::0 or ipv6.DstAddr >= 2001:1::0) and (ipv6.DstAddr < fc00::0 or ipv6.DstAddr >= fe00::0) and (ipv6.DstAddr < fe80::0 or ipv6.DstAddr >= fec0::0) and (ipv6.DstAddr < ff00::0 or ipv6.DstAddr >= ffff::0))
    )
 )
