anchor.diff:  * `cf running-security-groups`: Displays all security groups in the Default
   Running set
   * `cf security-group SECURITY-GROUP`: Displays details about the specified
  -security group+security group
  +
  +## <a id='example-groups'></a>Example Application Security Groups ##
  +These JSON snippets can be saved to a file and modified for use with any of the
  +commands above that take a `PATH-TO-RULES-FILE`.
  +
  +### <a id='c-class-example-group'></a>TCP and UDP to a C Class Network ###
  +
  +```json
  +[
  +	{"protocol":"tcp","destination":"10.0.11.0/24","ports":"1-65535"},
  +	{"protocol":"udp","destination":"10.0.11.0/24","ports":"1-65535"}
  +]
  +```
  +
  +### <a id='public-network-example-group'></a>Public Networks ###
  +
  +```json
  +[
  +	{"destination": "0.0.0.0-9.255.255.255","protocol": "all"},
  +	{"destination": "11.0.0.0-169.253.255.255","protocol": "all"},
  +	{"destination": "169.255.0.0-172.15.255.255","protocol": "all"},
  +	{"destination": "172.32.0.0-192.167.255.255","protocol": "all"},
  +	{"destination": "192.169.0.0-255.255.255.255","protocol": "all"}
  +]
  +```
  
positive.code: application containers in the space.
  A space may belong to more than one application security group.
  
  ## <a id='eval-sequence'></a>Rules Evaluation Sequence ##
  
  When multiple ASGs apply to a single container, any one of them can allow an outgoing message from its application. Because ASG rules define permitted traffic, the order in which Cloud Foundry evaluates them does not matter. The system merges the rules, and blocks all traffic not explicitly allowed by an ASG.
  
negative.code: 
  Application security groups defined within Cloud Foundry are not the same as security groups defined at the infrastructure level.
  
  ## <a id='creating-groups'></a>Creating / Updating Application Security Groups ##
  
  An ASG consists of a list of operator-defined network egress `allow`
  rules.
  