Can someone explain why ^.*0\.0\.0\.0.*$ detects packets containing 0.0.0.0 while ^.*sipvicious.*$|^.*friendly-scanner.*$|^.*iWar.*$|^.*sundayddr.*$|^.*sipcli.*$|^.*pjsua.*$|^.*VaxSIPUserAgent.*$|^.*100@1\.1\.1\.1.*$|^.*0\.0\.0\.0.*$doesn’t
For testing I have created some pass through rules so I can see the count of how many matches there have been.