IP-centric view — which rules tripped and sample evidence lines. Addresses are RFC 5737 TEST-NET only.