This example looks for any traffic where the Source IP and the Destination IP is the same.
alert ip any any -> any any (sameip;)
