For example, if an attack was carried out on the console, there will be and entry here to designate the victim of the attack (Destination field) and the Time/Duration of the console portion of the attack. Or in the case of a sweep or probe that hits all (or most of) a subnet within a small period of time, we might have condensed that attack, manually, into one or more entries using a wildcard of * for the final octet of the destination of victim ip.

In general the Destination field is also the Victim of the attack, however there are circumstances where the Victim is the Source of a tcpconnection, and thus the ip shows up in the Source column. In that situation, the scoring software matches the detected victim with the host in the Source column.

ATTACK: /data/id/1999/5week/thursday/sniffer/attacker/110416.ntinfoscan-129-probe--clear-hume/110416.ntinfoscan-129-probe--clear-hume.exs.list

ID#	Name	Date	Start	Duration	Service	Source	SrcPort	Dest.	DestPort	insider?	manual?	console?	success?	aDump?	oDump	iDump	BSM?	SysLogs	FSListing	Stealthy	New?	Category	OS
54.110416	ntinfoscan	04/08/1999	11:26:37	00:01:01	ftp	206.048.044.018	1253	172.016.112.100	21	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:26:38	00:00:01	ftp-data	172.016.112.100	20	206.048.044.018	20	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:27:38	00:00:01	telnet	206.048.044.018	1255	172.016.112.100	23	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:27:38	00:00:01	http	206.048.044.018	1256	172.016.112.100	80	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:27:38	00:00:01	http	206.048.044.018	1257	172.016.112.100	80	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:27:38	00:00:01	http	206.048.044.018	1258	172.016.112.100	80	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:27:38	00:00:01	http	206.048.044.018	1259	172.016.112.100	80	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:27:38	00:00:01	http	206.048.044.018	1260	172.016.112.100	80	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:27:38	00:00:01	http	206.048.044.018	1261	172.016.112.100	80	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:27:38	00:15:04	http	206.048.044.018	1262	172.016.112.100	80	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:42:42	00:00:01	http	206.048.044.018	1278	172.016.112.100	80	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:42:42	00:00:01	http	206.048.044.018	1279	172.016.112.100	80	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:42:42	00:00:01	http	206.048.044.018	1280	172.016.112.100	80	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:42:42	00:00:01	nbssn	206.048.044.018	1281	172.016.112.100	139	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:42:42	00:00:03	nbssn	206.048.044.018	1283	172.016.112.100	139	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT
54.110416	ntinfoscan	04/08/1999	11:42:45	00:00:01	http	206.048.044.018	1256	172.016.112.100	80	out	auto	rem	succ	aDmp	oDmp	iDmp	not	SysLg	FSLst	Clr	Old	llPROBE	llNT