It's really good reference from customer how it can be useful: https://github.com/rganascim/fastnetmon/commit/d28b8e3518c3f13e378fa4c8fd078c72d1787280
Proposed thresholds:
  1. NTP
  2. DNS
  3. LDAP
  4. GRE
  5. SSDP
  6. Chargen
  7. Protocol 0