#
#  Classify IP port numbers  - with compound statements
#
   IF SourcePeerType == IP save, {

      IF SourceTransAddress == (www, ftp, telnet) NOMATCH;
         # We want the well-known port as Dest

      IF DestTransAddress == telnet
         SAVE, STORE FlowKind := 'T';
      ELSE IF DestTransAddress == www
         SAVE, STORE FlowKind := 'W';
      ELSE IF DestTransAddress == ftp
         SAVE, STORE FlowKind := 'F';
      ELSE {
         SAVE DestTransAddress;
         STORE FlowKind := '?';
         }
      SAVE SourcePeerAddress /32;
      SAVE DestPeerAddress   /32;
      COUNT;
      }
   IGNORE;  # Not an IP packet


SET  7;  # NeMaC commands
FORMAT
 firsttime "  " topdus frompdus " # " tooctets fromoctets 
 sourcepeertype " \" "
 sourcepeeraddress destpeeraddress desttransaddress " \x3F "
 flowkind;  #  Must have the semicolon !
STATISTICS;