scrub:
normalization, defragmentation
scrub in all
antispoof:
"this packet should not be here"
drop packets from the wrong network
antispoof for $ext_if antispoof for $int_if