I've added the CTINVALID events of the firewall. Maybe be of interest also.
The color doeasn't mean anything. Just tried the numbers until the data 
were easily visible. ;)

-Bernhard