Note: we can use IP subnets in match: rule.MATCH(’IP_SRC’, subnet)