Snort mailing list archives
ID number in pcap files (Darpa 99)
From: Ibrahim Ahmed via Snort-users <snort-users () lists snort org>
Date: Fri, 18 May 2018 00:56:12 -0700
Hello, I had a question about the 'ID' feature in the tpdump file I got from the Darpa 1999 dataset. Two examples of packets from this file are below: *03/29-06:02:03.398394 135.8.60.182 -> 172.16.113.84* *PROTO:254 TTL:64 TOS:0x0 ID:1508 IpLen:20 DgmLen:20 DF* *=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+* *03/29-06:02:04.465788 135.8.60.182 -> 172.16.114.169* *PROTO:254 TTL:64 TOS:0x0 ID:1531 IpLen:20 DgmLen:20 DF* *=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+* I would like to know what the *ID* feature refers to - can anyone point me towards the documentation for such pcap files? Many thanks, Ibrahim
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- ID number in pcap files (Darpa 99) Ibrahim Ahmed via Snort-users (May 18)
- Re: ID number in pcap files (Darpa 99) Al Lewis (allewi) via Snort-users (May 19)
- Re: ID number in pcap files (Darpa 99) wkitty42 (May 19)