Toronto Web Hosting - Snort Intrusion Dection Guide

Appendix E     SNML DTD

 | The timestamp must conform to ISO 8601 standard.

 |    e.g., ISO 8601: 1999 08 04 00:01:23 05

 | A packet can be logged without being decoded using "raw"

 | mode. This encoding should only be used when a packet is

 | received containing protocols which cannot be decoded.

 | IP address (in dot quad notation).

 |   e.g., 10.1.2.3

 |  Note: Domain names are not valid.

 |  The version attribute is the version of IP address

 |  (should be 4 or 6).

          version   CDATA  #REQUIRED

 | IPv4 header

 |    saddr   = source IP address        IP address  IP  (192.168.1.2)

 |    daddr   = destination IP address   IP address  IP  (192.168.1.2)

 |    ver     = version of ip            1 byte INT (0   15)

 |    hlen    = header length in 32 bit words

 |                                       1 byte INT (0   15)

 |    tos     = type of service          1 byte INT (0   255)

 |    len     = total length of the packet

 |                                       2 byte INT (0   65535)

 |    id      = identification           2 byte INT (0   65535)

 |    flags   = fragment flags           1 byte INT (0   7)

 |    off     = fragment offset          2 byte INT (0   65535)

 |    ttl     = time to live             1 byte INT (0   255)

 |    proto   = protocol                 1 byte INT (0   255)

 |    csum    = checksum                 2 byte INT (0   65535)

footer