Expression Truncate Encrypted Traffic to the Internet

  - name: "Truncate external encrypted"
    when: "fieldSet"
    expression: "protocols == [tls, quic, ssh] && !isPrivate(ip.dst)"
    ops:
      _maxPacketsToSave: 20