Toronto Web Hosting - Snort Intrusion Dection Guide

Appendix E     SNML DTD

          ack       CDATA  #IMPLIED

          off       CDATA  #IMPLIED

          res       CDATA  #IMPLIED

          flags     CDATA  #REQUIRED

          win       CDATA  #IMPLIED

          csum      CDATA  #IMPLIED

          urp       CDATA  #IMPLIED

 | UDP header information

 |    sport   = source port              2 byte INT (0   65535)

 |    dport   = destination port         2 byte INT (0   65535)

 |    len     = length field of UDP header

 |                                       2 byte INT (0   65535)

 |    csum    = checksum                 2 byte INT (0   65535)

          sport     CDATA  #REQUIRED

          dport     CDATA  #REQUIRED

          len       CDATA  #IMPLIED

          csum      CDATA  #IMPLIED

 | ICMP header

 |    type    = icmp type                1 byte INT (0   255)

 |    code    = icmp code                1 byte INT (0   255)

 |    csum    = checksum                 2 byte INT (0   65535)

 |    id      = identifier               2 byte INT (0   65535)

 |    seq     = sequence number          2 byte INT (0   65535)

          type   CDATA #REQUIRED

          code   CDATA #REQUIRED

          csum   CDATA #IMPLIED

          id     CDATA #IMPLIED

          seq    CDATA #IMPLIED

]>

footer