Case-insensitive...
    tcp matches "(?i)somefilename\\.ext"
    frame matches "(?i)somefilename\\.ext"

HTTP....
	http.request || http.response
	http.request.method == "GET"

TCP MSS.....
	tcp.len >= 1400
	tcp.options.mss_val

PPP...
	ppp.protocol >= 128


SIP (excluding constant REGISTERs)
	sip and not (sip matches "(?i)cseq:\\s+\\d+\\s+register")