To authenticate data triggers, only the first packet is used for further processing. Subsequent packets from the same source are discarded until ESM host creation.
Data trigger packets are classified as all-unspecified protocol by Distributed CPU Protection (DCP).