This is an extensive listfile, including every network session that was part of the attack, listed individually, one per line. In additon, if there was no network traffic (but perhaps other evidence of an attack) a pseudo-listfile-entry is included here. These pseudo entries are generally indicated by information in the entry being excluded, or entered as a wildcard (*).

For example, if an attack was carried out on the console, there will be and entry here to designate the victim of the attack (Destination field) and the Time/Duration of the console portion of the attack. Or in the case of a sweep or probe that hits all (or most of) a subnet within a small period of time, we might have condensed that attack, manually, into one or more entries using a wildcard of * for the final octet of the destination of victim ip.

In general the Destination field is also the Victim of the attack, however there are circumstances where the Victim is the Source of a tcpconnection, and thus the ip shows up in the Source column. In that situation, the scoring software matches the detected victim with the host in the Source column.

ATTACK: /data/id/1999/4week/wednesday/sniffer/attacker/100000.ppmacro-20-r2l--clear-hume/100000.ppmacro-20-r2l--clear-hume.exs.list

ID# Name Date Start Duration Service Source SrcPort Dest. DestPort insider? manual? console? success? aDump? oDump iDump BSM? SysLogs FSListing Stealthy New? Category OS
43.100000 ppmacro 03/31/1999 10:14:36 00:00:04 smtp 194.027.251.021 1599 172.016.112.100 25 out man rem succ aDmp oDmp iDmp not SysLg FSLst Clr New llDATA-llR2L- llNT
43.100000 ppmacro 03/31/1999 10:14:36 00:00:03 nbns/u 172.016.112.100 137 194.027.251.021 137 out man rem succ aDmp oDmp iDmp not SysLg FSLst Clr New llDATA-llR2L- llNT
43.100000 ppmacro 03/31/1999 10:14:36 00:00:01 dur/i 194.027.251.021 - 172.016.112.100 - out man rem succ aDmp oDmp iDmp not SysLg FSLst Clr New llDATA-llR2L- llNT
43.100000 ppmacro 03/31/1999 10:23:37 00:00:01 http 194.027.251.021 1664 172.016.112.100 80 out man rem succ aDmp oDmp iDmp not SysLg FSLst Clr New llDATA-llR2L- llNT
43.100000 ppmacro 03/31/1999 10:24:03 00:00:01 http 194.027.251.021 1665 172.016.112.100 80 out man rem succ aDmp oDmp iDmp not SysLg FSLst Clr New llDATA-llR2L- llNT
43.100000 ppmacro 03/31/1999 10:24:09 00:00:01 http 194.027.251.021 1694 172.016.112.100 80 out man rem succ aDmp oDmp iDmp not SysLg FSLst Clr New llDATA-llR2L- llNT
43.100000 ppmacro 03/31/1999 10:26:10 00:00:01 http 194.027.251.021 1758 172.016.112.100 80 out man rem succ aDmp oDmp iDmp not SysLg FSLst Clr New llDATA-llR2L- llNT
43.100000 ppmacro 03/31/1999 10:26:21 00:00:56 http 194.027.251.021 1821 172.016.112.100 80 out man rem succ aDmp oDmp iDmp not SysLg FSLst Clr New llDATA-llR2L- llNT
43.100000 ppmacro 03/31/1999 10:27:21 00:00:16 http 194.027.251.021 1882 172.016.112.100 80 out man rem succ aDmp oDmp iDmp not SysLg FSLst Clr New llDATA-llR2L- llNT

ID#	Name	Date	Start	Duration	Service	Source	SrcPort	Dest.	DestPort	insider?	manual?	console?	success?	aDump?	oDump	iDump	BSM?	SysLogs	FSListing	Stealthy	New?	Category	OS
43.100000	ppmacro	03/31/1999	10:14:36	00:00:04	smtp	194.027.251.021	1599	172.016.112.100	25	out	man	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	New	llDATA-llR2L-	llNT
43.100000	ppmacro	03/31/1999	10:14:36	00:00:03	nbns/u	172.016.112.100	137	194.027.251.021	137	out	man	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	New	llDATA-llR2L-	llNT
43.100000	ppmacro	03/31/1999	10:14:36	00:00:01	dur/i	194.027.251.021	-	172.016.112.100	-	out	man	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	New	llDATA-llR2L-	llNT
43.100000	ppmacro	03/31/1999	10:23:37	00:00:01	http	194.027.251.021	1664	172.016.112.100	80	out	man	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	New	llDATA-llR2L-	llNT
43.100000	ppmacro	03/31/1999	10:24:03	00:00:01	http	194.027.251.021	1665	172.016.112.100	80	out	man	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	New	llDATA-llR2L-	llNT
43.100000	ppmacro	03/31/1999	10:24:09	00:00:01	http	194.027.251.021	1694	172.016.112.100	80	out	man	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	New	llDATA-llR2L-	llNT
43.100000	ppmacro	03/31/1999	10:26:10	00:00:01	http	194.027.251.021	1758	172.016.112.100	80	out	man	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	New	llDATA-llR2L-	llNT
43.100000	ppmacro	03/31/1999	10:26:21	00:00:56	http	194.027.251.021	1821	172.016.112.100	80	out	man	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	New	llDATA-llR2L-	llNT
43.100000	ppmacro	03/31/1999	10:27:21	00:00:16	http	194.027.251.021	1882	172.016.112.100	80	out	man	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	New	llDATA-llR2L-	llNT