Toronto Web Hosting - Snort Intrusion Dection Guide

          saddr     CDATA  #REQUIRED

          daddr     CDATA  #REQUIRED

          ver       CDATA  #REQUIRED

          hlen      CDATA  #IMPLIED

          tos       CDATA  #IMPLIED

          len       CDATA  #IMPLIED

          id        CDATA  #IMPLIED

          flags     CDATA  #IMPLIED

          ttl       CDATA  #IMPLIED

          off       CDATA  #IMPLIED

          ttl       CDATA  #IMPLIED

          proto     CDATA  #REQUIRED

          csum      CDATA  #IMPLIED

 | IP or TCP option

 |   option  = option code              1 byte INT (0   255)

 |   len     = length of option data    1 byte INT (0   255)

          code      CDATA  #REQUIRED

          len       CDATA  #IMPLIED

 | TCP header information

 |    sport   = source port              2 byte INT (0   65535)

 |    dport   = destination port         2 byte INT (0   65535)

 |    seq     = sequence number          4 byte INT (0   4294967295)

 |    ack     = acknowledgment number    4 byte INT (0   4294967295)

 |    off     = data offset              1 byte INT (0   15)

 |    res     = reserved field           1 byte INT (0   63)

 |    flags   = represents TCP flags     1 byte INT (0   255)

 |    win     = window                   2 byte INT (0   65535)

 |    csum    = checksum                 2 byte INT (0   65535)

 |    urp     = urgent pointer           2 byte INT (0   65535)

          sport     CDATA  #REQUIRED

          dport     CDATA  #REQUIRED

          seq       CDATA  #IMPLIED

footer