Wireshark display filter for mandiant report