The hosts moon, sun and dave install transport-mode trap policies with right=%any. The remote host is dynamically determined based on the acquires received from the kernel. Host dave additionally limits the remote hosts to moon and sun with rightsubnet. This is tested by pinging sun and carol from moon, carol from sun, and sun and moon from dave. The latter also pings carol, which is not going to be encrypted as carol is not part of the configured rightsubnet.