POLICIES=tcp alarm weird irc http ftp passwords scan ssh rsh udp worm smtp