Not use explictely 9997, but a REGEX() (look to other examples in .test). The same for host" and User-Agent.