Next: need for CIDR masks, Previous: Alert cascade, Up: Missing Documentation
E.g., src addr vs. dst addr, perhaps using attributes.