STAGE 1: INBOUND STAGE 2: RULE ENGINE STAGE 3: RESPONSE packet config INBOUND PROBE TTL: 64 SRC: 10.0.0.1 MODE: TUN/INLINE match(probe, rules) LITERAL VALUE $SRC SUBSTITUTION RANDOMIZED FIELD build_reply() build_rfc4950() SYNTHETIC RESPONSE TYPE: ICMP TIME EXCEEDED + ORIGINAL PROBE HEADER