This is an extensive listfile, including every network session that was part of the attack, listed individually, one per line. In additon, if there was no network traffic (but perhaps other evidence of an attack) a pseudo-listfile-entry is included here. These pseudo entries are generally indicated by information in the entry being excluded, or entered as a wildcard (*).

For example, if an attack was carried out on the console, there will be and entry here to designate the victim of the attack (Destination field) and the Time/Duration of the console portion of the attack. Or in the case of a sweep or probe that hits all (or most of) a subnet within a small period of time, we might have condensed that attack, manually, into one or more entries using a wildcard of * for the final octet of the destination of victim ip.

In general the Destination field is also the Victim of the attack, however there are circumstances where the Victim is the Source of a tcpconnection, and thus the ip shows up in the Source column. In that situation, the scoring software matches the detected victim with the host in the Source column.

ATTACK: /data/id/1999/5week/thursday/sniffer/traitor/091200.casesen-u2r--clear-hume/091200.casesen-u2r--clear-hume.exs.list

ID# Name Date Start Duration Service Source SrcPort Dest. DestPort insider? manual? console? success? aDump? oDump iDump BSM? SysLogs FSListing Stealthy New? Category OS
54.091200 cassen 04/08/1999 09:16:20 00:01:18 ftp 172.016.112.149 1026 172.016.112.100 21 in man rem succ aDmp not iDmp not SysLg not Clr New llU2R llNT
54.091200 cassen 04/08/1999 09:17:18 00:00:01 ftp-data 172.016.112.100 20 172.016.112.149 1027 in man rem succ aDmp not iDmp not SysLg not Clr New llU2R llNT
54.091200 cassen 04/08/1999 09:17:24 00:00:01 ftp-data 172.016.112.100 20 172.016.112.149 1028 in man rem succ aDmp not iDmp not SysLg not Clr New llU2R llNT
54.091200 cassen 04/08/1999 09:17:28 00:00:01 ftp-data 172.016.112.100 20 172.016.112.149 1029 in man rem succ aDmp not iDmp not SysLg not Clr New llU2R llNT
54.091200 cassen 04/08/1999 09:17:33 00:00:01 ftp-data 172.016.112.100 20 172.016.112.149 1048 in man rem succ aDmp not iDmp not SysLg not Clr New llU2R llNT
54.091200 cassen 04/08/1999 09:17:52 00:09:43 telnet 172.016.112.149 1049 172.016.112.100 23 in man rem succ aDmp not iDmp not SysLg not Clr New llU2R llNT
54.091200 cassen 04/08/1999 11:14:29 00:05:38 telnet 172.016.112.149 1108 172.016.112.100 23 in man rem succ aDmp not iDmp not SysLg not Clr New llU2R llNT

ID#	Name	Date	Start	Duration	Service	Source	SrcPort	Dest.	DestPort	insider?	manual?	console?	success?	aDump?	oDump	iDump	BSM?	SysLogs	FSListing	Stealthy	New?	Category	OS
54.091200	cassen	04/08/1999	09:16:20	00:01:18	ftp	172.016.112.149	1026	172.016.112.100	21	in	man	rem	succ	aDmp	not	iDmp	not	SysLg	not	Clr	New	llU2R	llNT
54.091200	cassen	04/08/1999	09:17:18	00:00:01	ftp-data	172.016.112.100	20	172.016.112.149	1027	in	man	rem	succ	aDmp	not	iDmp	not	SysLg	not	Clr	New	llU2R	llNT
54.091200	cassen	04/08/1999	09:17:24	00:00:01	ftp-data	172.016.112.100	20	172.016.112.149	1028	in	man	rem	succ	aDmp	not	iDmp	not	SysLg	not	Clr	New	llU2R	llNT
54.091200	cassen	04/08/1999	09:17:28	00:00:01	ftp-data	172.016.112.100	20	172.016.112.149	1029	in	man	rem	succ	aDmp	not	iDmp	not	SysLg	not	Clr	New	llU2R	llNT
54.091200	cassen	04/08/1999	09:17:33	00:00:01	ftp-data	172.016.112.100	20	172.016.112.149	1048	in	man	rem	succ	aDmp	not	iDmp	not	SysLg	not	Clr	New	llU2R	llNT
54.091200	cassen	04/08/1999	09:17:52	00:09:43	telnet	172.016.112.149	1049	172.016.112.100	23	in	man	rem	succ	aDmp	not	iDmp	not	SysLg	not	Clr	New	llU2R	llNT
54.091200	cassen	04/08/1999	11:14:29	00:05:38	telnet	172.016.112.149	1108	172.016.112.100	23	in	man	rem	succ	aDmp	not	iDmp	not	SysLg	not	Clr	New	llU2R	llNT