How to tell if your employees are spending time at work playing one of the most popular online poker sites for US citizens? Simple:   alert tcp $HOME_NET any -> [161.22.49.0/24] any (msg:”BetOnline Poker Detected”; content:”poker.betonline.ag”; tag: session, 60, seconds; sid:20161019; rev:1;)   2016-10-19 17:59:40.731904 IP 192.168.1.102.61567 > 161.22.49.233.443: Flags [R.], seq 1, ack 1, win 0, length 0 E..(4.@…1….f..1………..I.P…<……… 2016-10-19 17:59:40.732414 IP 192.168.1.102.61568 > 161.22.49.233.443: Flags [S], seq 1713469354, win 65535, options [mss 1460,nop,wscale 3,nop,nop,sackO K], length 0 E..44.@…1….f..1…..f!w……… …………… 2016-10-19 17:59:40.824057 IP 192.168.1.102.61568 > 161.22.49.233.443: Flags [.], ack 1826761741, win 32768, length 0 E..(4.@…1….f..1…..f!w.l.,.P…1……… 2016-10-19 17:59:40.824462 IP 192.168.1.102.61568 […]