!impostor and !loopback and
 (outbound and
  udp.DstPort>=50000 and udp.DstPort<=50099 and
  udp.PayloadLength=74 and
  udp.Payload32[0]=0x00010046 and
  udp.Payload32[2]=0 and
  udp.Payload32[3]=0 and
  udp.Payload32[4]=0 and
  udp.Payload32[5]=0 and
  udp.Payload32[6]=0 and
  udp.Payload32[7]=0 and
  udp.Payload32[8]=0 and
  udp.Payload32[9]=0 and
  udp.Payload32[10]=0 and
  udp.Payload32[11]=0 and
  udp.Payload32[12]=0 and
  udp.Payload32[13]=0 and
  udp.Payload32[14]=0 and
  udp.Payload32[15]=0 and
  udp.Payload32[16]=0 and
  udp.Payload32[17]=0 and
  (ip.DstAddr < 127.0.0.1 or ip.DstAddr > 127.255.255.255) and (ip.DstAddr < 10.0.0.0 or ip.DstAddr > 10.255.255.255) and (ip.DstAddr < 192.168.0.0 or ip.DstAddr > 192.168.255.255) and (ip.DstAddr < 172.16.0.0 or ip.DstAddr > 172.31.255.255) and (ip.DstAddr < 169.254.0.0 or ip.DstAddr > 169.254.255.255)
 )
