Filtering
Filterable Attributes (protocol dependant)

Source/destination port (TCP and UDP)
ICMP code and type (ICMP)
User/group (TCP and UDP)
TCP flags (TCP)
Source OS (TCP)