Hello Inge, aggregate_filter can match any packet/flow primitives with the exception of IDs. This task is accomplished by pre_tag_filter . I'm just figuring out that there aren't examples for such directive around. However, it's use is pretty simple:
pre_tag_filter: IDx [, IDy] [, IDz] Cheers, Paolo
