you want an L7 rule for "unknown traffic" ? :) unknown traffic is exactly that - NOT known, not identified by any rules. If you start identifyint it, it becomes known traffic :) Please clarify what you want exactly. Do you want to add a new type of L7 matcher, that is not in the wiki? jes...