a = "ssh"
b = "ftp"
c = "ssh ftp"
d = "ssh ftp ssh ftp"
e = "ssh ftp ftp test ssh ftp"
pass in proto tcp from any to any port = ssh
pass in proto tcp from any to any port = ftp