1match scrub(no-df no-df) 2match scrub(min-ttl 4 min-ttl 5) 3match in all scrub(min-ttl 256) 4match out scrub(min-ttl 65536) 5match in from localhost to localhost scrub(max-mss 512 max-mss 1280) 6match from localhost scrub(random-id random-id) 7