root
                           | (100%)
                           +-------------------------------+
                           |                               |
                        def_class                          |
                           | (95%)                         |
            +--------------+---------------+               |
            |(tcp)         |(icmp)         |(udp)          |
        firstclass   generalclass    businessclass         |
            | (70%)        | (5%)          | (15%)         |
   +---+-----+-----+       |             +-+---+           |
   |   |     |     |       |             |     |           |
  dns tcp   smtp  http    icmp          udp   dns     ctl_class
 (2%) (28%) (10%) (30%)   (5%)         (10%) (5%)       (4%)