The alias all has the same ef- fect. Only TCP packets match. Only this exact ip number match the rule. In this case all ip numbers from 1.2.3.0 to 1.2.3.255 will match. See the frag option for details on matching fragmented packets.
Rules can apply to packets when they are incoming, or outgoing, or both.
The in keyword indicates the rule should only match incoming packets. The out keyword indicates the rule should only match outgoing packets. Packet must be going through interface ifX , where X is any unit number. The via keyword causes the interface to always be checked. The recv interface can be tested on either incoming or outgoing packets, while the xmit interface can only be tested on outgoing packets.