Fw monitor
From cpwiki.net
4 chain, all bidirectional traffic between 2 hosts
fw monitor -m iIoO -e "accept src=192.168.1.1 and dst=10.0.0.1; accept src=10.0.0.1 and dst=192.168.0.1;"
capture icmp packets only from host x
fw monitor -m iIoO -e "ip_p=1,host(192.168.1.1), accept;"