;COMMENT: Blacklist on 30 dropped packets
;DESCRIPTION: Blacklists remote IP addresses responsible for 30 dropped packets. The packets must be incoming and show up within 30 minutes. The blacklisting period is set to 12 hours (per default).

Dropped-Limit-Blacklist	
		Comment = "Blacklist on 30 dropped packets within 30 minutes",
		Rule-Action = Observe,
		Observation-Period = "00:30",
		Observe-Match-Count = 29,
		Packet-Feature = Dropped,
		Direction = Incoming,
