Main Page | Modules | Class List | Directories | File List | Class Members | File Members | Related Pages

generators.h File Reference

Go to the source code of this file.

Defines

#define GENERATOR_SNORT_ENGINE   1
#define GENERATOR_TAG   2
#define TAG_LOG_PKT   1
#define GENERATOR_SPP_PORTSCAN   100
#define PORTSCAN_SCAN_DETECT   1
#define PORTSCAN_INTER_INFO   2
#define PORTSCAN_SCAN_END   3
#define GENERATOR_SPP_MINFRAG   101
#define MINFRAG_ALERT_ID   1
#define GENERATOR_SPP_HTTP_DECODE   102
#define HTTP_DECODE_UNICODE_ATTACK   1
#define HTTP_DECODE_CGINULL_ATTACK   2
#define HTTP_DECODE_LARGE_METHOD   3
#define HTTP_DECODE_MISSING_URI   4
#define HTTP_DECODE_DOUBLE_ENC   5
#define HTTP_DECODE_ILLEGAL_HEX   6
#define HTTP_DECODE_OVERLONG_CHAR   7
#define GENERATOR_SPP_DEFRAG   103
#define DEFRAG_FRAG_OVERFLOW   1
#define DEFRAG_FRAGS_DISCARDED   2
#define GENERATOR_SPP_SPADE   104
#define SPADE_ANOM_THRESHOLD_EXCEEDED   1
#define SPADE_ANOM_THRESHOLD_ADJUSTED   2
#define GENERATOR_SPP_BO   105
#define BO_TRAFFIC_DETECT   1
#define BO_CLIENT_TRAFFIC_DETECT   2
#define BO_SERVER_TRAFFIC_DETECT   3
#define BO_SNORT_BUFFER_ATTACK   4
#define GENERATOR_SPP_RPC_DECODE   106
#define RPC_FRAG_TRAFFIC   1
#define RPC_MULTIPLE_RECORD   2
#define RPC_LARGE_FRAGSIZE   3
#define RPC_INCOMPLETE_SEGMENT   4
#define RPC_ZERO_LENGTH_FRAGMENT   5
#define GENERATOR_SPP_STREAM2   107
#define GENERATOR_SPP_STREAM3   108
#define GENERATOR_SPP_TELNET_NEG   109
#define GENERATOR_SPP_UNIDECODE   110
#define UNIDECODE_CGINULL_ATTACK   1
#define UNIDECODE_DIRECTORY_TRAVERSAL   2
#define UNIDECODE_UNKNOWN_MAPPING   3
#define UNIDECODE_INVALID_MAPPING   4
#define GENERATOR_SPP_STREAM4   111
#define STREAM4_STEALTH_ACTIVITY   1
#define STREAM4_EVASIVE_RST   2
#define STREAM4_EVASIVE_RETRANS   3
#define STREAM4_WINDOW_VIOLATION   4
#define STREAM4_DATA_ON_SYN   5
#define STREAM4_STEALTH_FULL_XMAS   6
#define STREAM4_STEALTH_SAPU   7
#define STREAM4_STEALTH_FIN_SCAN   8
#define STREAM4_STEALTH_NULL_SCAN   9
#define STREAM4_STEALTH_NMAP_XMAS_SCAN   10
#define STREAM4_STEALTH_VECNA_SCAN   11
#define STREAM4_STEALTH_NMAP_FINGERPRINT   12
#define STREAM4_STEALTH_SYN_FIN_SCAN   13
#define STREAM4_FORWARD_OVERLAP   14
#define STREAM4_TTL_EVASION   15
#define STREAM4_EVASIVE_RETRANS_DATA   16
#define STREAM4_EVASIVE_RETRANS_DATASPLIT   17
#define STREAM4_MULTIPLE_ACKED   18
#define STREAM4_EMERGENCY   19
#define STREAM4_SUSPEND   20
#define STREAM4_ZERO_TIMESTAMP   21
#define STREAM4_OVERLAP_LIMIT   22
#define STREAM4_TCP_NO_ACK   23
#define GENERATOR_SPP_ARPSPOOF   112
#define ARPSPOOF_UNICAST_ARP_REQUEST   1
#define ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC   2
#define ARPSPOOF_ETHERFRAME_ARP_MISMATCH_DST   3
#define ARPSPOOF_ARP_CACHE_OVERWRITE_ATTACK   4
#define GENERATOR_SPP_FRAG2   113
#define FRAG2_OVERSIZE_FRAG   1
#define FRAG2_TEARDROP   2
#define FRAG2_TTL_EVASION   3
#define FRAG2_OVERLAP   4
#define FRAG2_DUPFIRST   5
#define FRAG2_MEM_EXCEED   6
#define FRAG2_OUTOFORDER   7
#define FRAG2_IPOPTIONS   8
#define FRAG2_EMERGENCY   9
#define FRAG2_SUSPEND   10
#define GENERATOR_SPP_FNORD   114
#define FNORD_NOPSLED   1
#define GENERATOR_SPP_ASN1   115
#define ASN1_INDEFINITE_LENGTH   1
#define ASN1_INVALID_LENGTH   2
#define ASN1_OVERSIZED_ITEM   3
#define ASN1_SPEC_VIOLATION   4
#define ASN1_DATUM_BAD_LENGTH   5
#define GENERATOR_SNORT_DECODE   116
#define DECODE_NOT_IPV4_DGRAM   1
#define DECODE_IPV4_INVALID_HEADER_LEN   2
#define DECODE_IPV4_DGRAM_LT_IPHDR   3
#define DECODE_IPV4OPT_BADLEN   4
#define DECODE_IPV4OPT_TRUNCATED   5
#define DECODE_TCP_DGRAM_LT_TCPHDR   45
#define DECODE_TCP_INVALID_OFFSET   46
#define DECODE_TCP_LARGE_OFFSET   47
#define DECODE_TCPOPT_BADLEN   54
#define DECODE_TCPOPT_TRUNCATED   55
#define DECODE_TCPOPT_TTCP   56
#define DECODE_TCPOPT_OBSOLETE   57
#define DECODE_TCPOPT_EXPERIMENT   58
#define DECODE_UDP_DGRAM_LT_UDPHDR   95
#define DECODE_UDP_DGRAM_INVALID_LENGTH   96
#define DECODE_UDP_DGRAM_SHORT_PACKET   97
#define DECODE_ICMP_DGRAM_LT_ICMPHDR   105
#define DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR   106
#define DECODE_ICMP_DGRAM_LT_ADDRHDR   107
#define DECODE_IPV4_DGRAM_UNKNOWN   108
#define DECODE_ARP_TRUNCATED   109
#define DECODE_EAPOL_TRUNCATED   110
#define DECODE_EAPKEY_TRUNCATED   111
#define DECODE_EAP_TRUNCATED   112
#define DECODE_BAD_PPPOE   120
#define DECODE_BAD_VLAN   130
#define DECODE_BAD_VLAN_ETHLLC   131
#define DECODE_BAD_VLAN_OTHER   132
#define DECODE_BAD_80211_ETHLLC   133
#define DECODE_BAD_80211_OTHER   134
#define DECODE_BAD_TRH   140
#define DECODE_BAD_TR_ETHLLC   141
#define DECODE_BAD_TR_MR_LEN   142
#define DECODE_BAD_TRHMR   143
#define DECODE_BAD_TRAFFIC_LOOPBACK   150
#define DECODE_BAD_TRAFFIC_SAME_SRCDST   151
#define GENERATOR_SPP_SCAN2   117
#define SCAN_TYPE   1
#define GENERATOR_SPP_CONV   118
#define CONV_BAD_IP_PROTOCOL   1
#define GENERATOR_SPP_HTTP_INSPECT_CLIENT   119
#define HI_CLIENT_ASCII   1
#define HI_CLIENT_DOUBLE_DECODE   2
#define HI_CLIENT_U_ENCODE   3
#define HI_CLIENT_BARE_BYTE   4
#define HI_CLIENT_BASE36   5
#define HI_CLIENT_UTF_8   6
#define HI_CLIENT_IIS_UNICODE   7
#define HI_CLIENT_MULTI_SLASH   8
#define HI_CLIENT_IIS_BACKSLASH   9
#define HI_CLIENT_SELF_DIR_TRAV   10
#define HI_CLIENT_DIR_TRAV   11
#define HI_CLIENT_APACHE_WS   12
#define HI_CLIENT_IIS_DELIMITER   13
#define HI_CLIENT_NON_RFC_CHAR   14
#define HI_CLIENT_OVERSIZE_DIR   15
#define HI_CLIENT_LARGE_CHUNK   16
#define HI_CLIENT_PROXY_USE   17
#define HI_CLIENT_WEBROOT_DIR   18
#define GENERATOR_SPP_HTTP_INSPECT_ANOM_SERVER   120
#define HI_ANOM_SERVER_ALERT   1
#define GENERATOR_FLOW_PORTSCAN   121
#define FLOW_SCANNER_FIXED_ALERT   1
#define FLOW_SCANNER_SLIDING_ALERT   2
#define FLOW_TALKER_FIXED_ALERT   3
#define FLOW_TALKER_SLIDING_ALERT   4
#define GENERATOR_PSNG   122
#define PSNG_TCP_PORTSCAN   1
#define PSNG_TCP_DECOY_PORTSCAN   2
#define PSNG_TCP_PORTSWEEP   3
#define PSNG_TCP_DISTRIBUTED_PORTSCAN   4
#define PSNG_TCP_FILTERED_PORTSCAN   5
#define PSNG_TCP_FILTERED_DECOY_PORTSCAN   6
#define PSNG_TCP_PORTSWEEP_FILTERED   7
#define PSNG_TCP_FILTERED_DISTRIBUTED_PORTSCAN   8
#define PSNG_IP_PORTSCAN   9
#define PSNG_IP_DECOY_PORTSCAN   10
#define PSNG_IP_PORTSWEEP   11
#define PSNG_IP_DISTRIBUTED_PORTSCAN   12
#define PSNG_IP_FILTERED_PORTSCAN   13
#define PSNG_IP_FILTERED_DECOY_PORTSCAN   14
#define PSNG_IP_PORTSWEEP_FILTERED   15
#define PSNG_IP_FILTERED_DISTRIBUTED_PORTSCAN   16
#define PSNG_UDP_PORTSCAN   17
#define PSNG_UDP_DECOY_PORTSCAN   18
#define PSNG_UDP_PORTSWEEP   19
#define PSNG_UDP_DISTRIBUTED_PORTSCAN   20
#define PSNG_UDP_FILTERED_PORTSCAN   21
#define PSNG_UDP_FILTERED_DECOY_PORTSCAN   22
#define PSNG_UDP_PORTSWEEP_FILTERED   23
#define PSNG_UDP_FILTERED_DISTRIBUTED_PORTSCAN   24
#define PSNG_ICMP_PORTSWEEP   25
#define PSNG_ICMP_PORTSWEEP_FILTERED   26
#define PSNG_OPEN_PORT   27
#define GENERATOR_SPP_CLAMAV   123
#define CLAMAV_VIRUSFOUND   1
#define GENERATOR_SMTP   124
#define ARPSPOOF_UNICAST_ARP_REQUEST_STR   "(spp_arpspoof) Unicast ARP request"
#define ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC_STR   "(spp_arpspoof) Ethernet/ARP Mismatch request for Source"
#define ARPSPOOF_ETHERFRAME_ARP_MISMATCH_DST_STR   "(spp_arpspoof) Ethernet/ARP Mismatch request for Destination"
#define ARPSPOOF_ARP_CACHE_OVERWRITE_ATTACK_STR   "(spp_arpspoof) Attempted ARP cache overwrite attack"
#define ASN1_INDEFINITE_LENGTH_STR   "(spp_asn1) Indefinite ASN.1 length encoding"
#define ASN1_INVALID_LENGTH_STR   "(spp_asn1) Invalid ASN.1 length encoding"
#define ASN1_OVERSIZED_ITEM_STR   "(spp_asn1) ASN.1 oversized item, possible overflow"
#define ASN1_SPEC_VIOLATION_STR   "(spp_asn1) ASN.1 spec violation, possible overflow"
#define ASN1_DATUM_BAD_LENGTH_STR   "(spp_asn1) ASN.1 Attack: Datum length > packet length"
#define BO_TRAFFIC_DETECT_STR   "(spo_bo) Back Orifice Traffic detected"
#define BO_CLIENT_TRAFFIC_DETECT_STR   "(spo_bo) Back Orifice Client Traffic detected"
#define BO_SERVER_TRAFFIC_DETECT_STR   "(spo_bo) Back Orifice Server Traffic detected"
#define BO_SNORT_BUFFER_ATTACK_STR   "(spo_bo) Back Orifice Snort buffer attack"
#define FNORD_NOPSLED_IA32_STR   "(spp_fnord) Possible Mutated IA32 NOP Sled detected"
#define FNORD_NOPSLED_HPPA_STR   "(spp_fnord) Possible Mutated HPPA NOP Sled detected"
#define FNORD_NOPSLED_SPARC_STR   "(spp_fnord) Possible Mutated SPARC NOP Sled detected"
#define FRAG2_DUPFIRST_STR   "(spp_frag2) Duplicate first fragments"
#define FRAG2_IPOPTIONS_STR   "(spp_frag2) IP Options on Fragmented Packet"
#define FRAG2_OUTOFORDER_STR   "(spp_frag2) Out of order fragments"
#define FRAG2_OVERLAP_STR   "(spp_frag2) Overlapping new fragment (probable fragroute)"
#define FRAG2_OVERSIZE_FRAG_STR   "(spp_frag2) Oversized fragment, probable DoS"
#define FRAG2_TEARDROP_STR   "(spp_frag2) Teardrop attack"
#define FRAG2_TTL_EVASION_STR   "(spp_frag2) TTL Limit Exceeded (reassemble) detection"
#define FRAG2_EMERGENCY_STR   "(spp_frag2) Shifting to Emergency Session Mode"
#define FRAG2_SUSPEND_STR   "(spp_frag2) Shifting to Suspend Mode"
#define GENERATOR_SPP_FRAG3   123
#define FRAG3_IPOPTIONS   1
#define FRAG3_TEARDROP   2
#define FRAG3_SHORT_FRAG   3
#define FRAG3_ANOMALY_OVERSIZE   4
#define FRAG3_ANOMALY_ZERO   5
#define FRAG3_ANOMALY_BADSIZE_SM   6
#define FRAG3_ANOMALY_BADSIZE_LG   7
#define FRAG3_ANOMALY_OVLP   8
#define HTTP_DECODE_LARGE_METHOD_STR   "(spp_http_decode) A large HTTP method was received"
#define HTTP_DECODE_MISSING_URI_STR   "(spp_http_decode) HTTP request without URI"
#define HTTP_DECODE_DOUBLE_ENC_STR   "(spp_http_decode) Double Hex Encoding Received"
#define HTTP_DECODE_ILLEGAL_HEX_STR   "(spp_http_decode) Illegal URL hex encoding"
#define HTTP_DECODE_OVERLONG_CHAR_STR   "(spp_http_decode) Overlong Unicode character received"
#define STREAM4_MULTIPLE_ACKED_STR   "(spp_stream4) Multiple Acked Packets (possible fragroute)"
#define STREAM4_DATA_ON_SYN_STR   "(spp_stream4) DATA ON SYN detection"
#define STREAM4_STEALTH_NMAP_FINGERPRINT_STR   "(spp_stream4) NMAP FINGERPRINT (stateful) detection"
#define STREAM4_STEALTH_FULL_XMAS_STR   "(spp_stream4) STEALTH ACTIVITY (Full XMAS scan) detection"
#define STREAM4_STEALTH_SAPU_STR   "(spp_stream4) STEALTH ACTIVITY (SAPU scan) detection"
#define STREAM4_STEALTH_FIN_SCAN_STR   "(spp_stream4) STEALTH ACTIVITY (FIN scan) detection"
#define STREAM4_STEALTH_SYN_FIN_SCAN_STR   "(spp_stream4) STEALTH ACTIVITY (SYN FIN scan) detection"
#define STREAM4_STEALTH_NULL_SCAN_STR   "(spp_stream4) STEALTH ACTIVITY (NULL scan) detection"
#define STREAM4_STEALTH_NMAP_XMAS_SCAN_STR   "(spp_stream4) STEALTH ACTIVITY (XMAS scan) detection"
#define STREAM4_STEALTH_VECNA_SCAN_STR   "(spp_stream4) STEALTH ACTIVITY (Vecna scan) detection"
#define STREAM4_STEALTH_ACTIVITY_STR   "(spp_stream4) STEALTH ACTIVITY (unknown) detection"
#define STREAM4_EVASIVE_RST_STR   "(spp_stream4) possible EVASIVE RST detection"
#define STREAM4_TTL_EVASION_STR   "(spp_stream4) TTL LIMIT Exceeded"
#define STREAM4_EVASIVE_RETRANS_STR   "(spp_stream4) Possible RETRANSMISSION detection"
#define STREAM4_WINDOW_VIOLATION_STR   "(spp_stream4) WINDOW VIOLATION detection"
#define STREAM4_EVASIVE_RETRANS_DATA_STR   "(spp_stream4) TCP CHECKSUM CHANGED ON RETRANSMISSION (possible fragroute) detection"
#define STREAM4_FORWARD_OVERLAP_STR   "(spp_stream4) FORWARD OVERLAP detection"
#define STREAM4_EVASIVE_RETRANS_DATASPLIT_STR   "(spp_stream4) TCP TOO FAST RETRANSMISSION WITH DIFFERENT DATA SIZE (possible fragroute) detection"
#define STREAM4_EMERGENCY_STR   "(spp_stream4) Shifting to Emergency Session Mode"
#define STREAM4_SUSPEND_STR   "(spp_stream4) Shifting to Suspend Mode"
#define STREAM4_ZERO_TIMESTAMP_STR   "(spp_stream4) TCP Option Timestamp value of 0"
#define STREAM4_OVERLAP_LIMIT_STR   "(spp_stream4) TCP stream too many overlapping packets"
#define STREAM4_TCP_NO_ACK_STR   "(spp_stream4) Packet in Established TCP stream missing ACK"
#define FRAG3_IPOPTIONS_STR   "(spp_frag3) Inconsistent IP Options on Fragmented Packets"
#define FRAG3_TEARDROP_STR   "(spp_frag3) Teardrop attack"
#define FRAG3_SHORT_FRAG_STR   "(spp_frag3) Short fragment, possible DoS attempt"
#define FRAG3_ANOM_OVERSIZE_STR   "(spp_frag3) Fragment packet ends after defragmented packet"
#define FRAG3_ANOM_ZERO_STR   "(spp_frag3) Zero-byte fragment packet"
#define FRAG3_ANOM_BADSIZE_SM_STR   "(spp_frag3) Bad fragment size, packet size is negative"
#define FRAG3_ANOM_BADSIZE_LG_STR   "(spp_frag3) Bad fragment size, packet size is greater than 65536"
#define FRAG3_ANOM_OVLP_STR   "(spp_frag3) Fragmentation overlap"
#define DECODE_NOT_IPV4_DGRAM_STR   "(snort_decoder) WARNING: Not IPv4 datagram!"
#define DECODE_IPV4_INVALID_HEADER_LEN_STR   "(snort_decoder) WARNING: hlen < IP_HEADER_LEN!"
#define DECODE_IPV4_DGRAM_LT_IPHDR_STR   "(snort_decoder) WARNING: IP dgm len < IP Hdr len!"
#define DECODE_IPV4OPT_BADLEN_STR   "(snort_decoder): Ipv4 Options found with bad lengths"
#define DECODE_IPV4OPT_TRUNCATED_STR   "(snort_decoder): Truncated Ipv4 Options"
#define DECODE_TCP_DGRAM_LT_TCPHDR_STR   "(snort_decoder) TCP packet len is smaller than 20 bytes!"
#define DECODE_TCP_INVALID_OFFSET_STR   "(snort_decoder) WARNING: TCP Data Offset is less than 5!"
#define DECODE_TCP_LARGE_OFFSET_STR   "(snort_decoder) WARNING: TCP Header length exceeds packet length!"
#define DECODE_TCPOPT_BADLEN_STR   "(snort_decoder): Tcp Options found with bad lengths"
#define DECODE_TCPOPT_TRUNCATED_STR   "(snort_decoder): Truncated Tcp Options"
#define DECODE_TCPOPT_TTCP_STR   "(snort_decoder): T/TCP Detected"
#define DECODE_TCPOPT_OBSOLETE_STR   "(snort_decoder): Obsolete TCP Options found"
#define DECODE_TCPOPT_EXPERIMENT_STR   "(snort_decoder): Experimental Tcp Options found"
#define DECODE_UDP_DGRAM_LT_UDPHDR_STR   "(snort_decoder) WARNING: Truncated UDP Header!"
#define DECODE_UDP_DGRAM_INVALID_LENGTH_STR   "(snort_decoder): Invalid UDP header, length field < 8"
#define DECODE_UDP_DGRAM_SHORT_PACKET_STR   "(snort_decoder): Short UDP packet, length field > payload length"
#define DECODE_ICMP_DGRAM_LT_ICMPHDR_STR   "(snort_decoder) WARNING: ICMP Header Truncated!"
#define DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR_STR   "(snort_decoder) WARNING: ICMP Timestamp Header Truncated!"
#define DECODE_ICMP_DGRAM_LT_ADDRHDR_STR   "(snort_decoder) WARNING: ICMP Address Header Truncated!"
#define DECODE_IPV4_DGRAM_UNKNOWN_STR   "(snort_decoder) Unknown Datagram decoding problem!"
#define DECODE_ARP_TRUNCATED_STR   "(snort_decoder) WARNING: Truncated ARP!"
#define DECODE_EAPOL_TRUNCATED_STR   "(snort_decoder) WARNING: Truncated EAP Header!"
#define DECODE_EAPKEY_TRUNCATED_STR   "(snort_decoder) WARNING: EAP Key Truncated!"
#define DECODE_EAP_TRUNCATED_STR   "(snort_decoder) WARNING: EAP Header Truncated!"
#define DECODE_BAD_PPPOE_STR   "(snort_decoder) WARNING: Bad PPPOE frame detected!"
#define DECODE_BAD_VLAN_STR   "(snort_decoder) WARNING: Bad VLAN Frame!"
#define DECODE_BAD_VLAN_ETHLLC_STR   "(snort_decoder) WARNING: Bad LLC header!"
#define DECODE_BAD_VLAN_OTHER_STR   "(snort_decoder) WARNING: Bad Extra LLC Info!"
#define DECODE_BAD_80211_ETHLLC_STR   "(snort_decoder) WARNING: Bad 802.11 LLC header!"
#define DECODE_BAD_80211_OTHER_STR   "(snort_decoder) WARNING: Bad 802.11 Extra LLC Info!"
#define DECODE_BAD_TRH_STR   "(snort_decoder) WARNING: Bad Token Ring Header!"
#define DECODE_BAD_TR_ETHLLC_STR   "(snort_decoder) WARNING: Bad Token Ring ETHLLC Header!"
#define DECODE_BAD_TR_MR_LEN_STR   "(snort_decoder) WARNING: Bad Token Ring MRLENHeader!"
#define DECODE_BAD_TRHMR_STR   "(snort_decoder) WARNING: Bad Token Ring MR Header!"
#define DECODE_BAD_TRAFFIC_LOOPBACK_STR   "(snort decoder) Bad Traffic Loopback IP"
#define DECODE_BAD_TRAFFIC_SAME_SRCDST_STR   "(snort decoder) Bad Traffic Same Src/Dst IP"
#define SCAN2_PREFIX_STR   "(spp_portscan2) Portscan detected from "
#define CONV_BAD_IP_PROTOCOL_STR   "(spp_conversation) Bad IP protocol!"
#define RPC_FRAG_TRAFFIC_STR   "(spp_rpc_decode) Fragmented RPC Records"
#define RPC_MULTIPLE_RECORD_STR   "(spp_rpc_decode) Multiple RPC Records"
#define RPC_LARGE_FRAGSIZE_STR   "(spp_rpc_decode) Large RPC Record Fragment"
#define RPC_INCOMPLETE_SEGMENT_STR   "(spp_rpc_decode) Incomplete RPC segment"
#define RPC_ZERO_LENGTH_FRAGMENT_STR   "(spp_rpc_decode) Zero-length RPC Fragment"
#define PSNG_TCP_PORTSCAN_STR   "(portscan) TCP Portscan"
#define PSNG_TCP_DECOY_PORTSCAN_STR   "(portscan) TCP Decoy Portscan"
#define PSNG_TCP_PORTSWEEP_STR   "(portscan) TCP Portsweep"
#define PSNG_TCP_DISTRIBUTED_PORTSCAN_STR   "(portscan) TCP Distributed Portscan"
#define PSNG_TCP_FILTERED_PORTSCAN_STR   "(portscan) TCP Filtered Portscan"
#define PSNG_TCP_FILTERED_DECOY_PORTSCAN_STR   "(portscan) TCP Filtered Decoy Portscan"
#define PSNG_TCP_FILTERED_DISTRIBUTED_PORTSCAN_STR   "(portscan) TCP Filtered Distributed Portscan"
#define PSNG_TCP_PORTSWEEP_FILTERED_STR   "(portscan) TCP Filtered Portsweep"
#define PSNG_IP_PORTSCAN_STR   "(portscan) IP Protocol Scan"
#define PSNG_IP_DECOY_PORTSCAN_STR   "(portscan) IP Decoy Protocol Scan"
#define PSNG_IP_PORTSWEEP_STR   "(portscan) IP Protocol Sweep"
#define PSNG_IP_DISTRIBUTED_PORTSCAN_STR   "(portscan) IP Distributed Protocol Scan"
#define PSNG_IP_FILTERED_PORTSCAN_STR   "(portscan) IP Filtered Protocol Scan"
#define PSNG_IP_FILTERED_DECOY_PORTSCAN_STR   "(portscan) IP Filtered Decoy Protocol Scan"
#define PSNG_IP_FILTERED_DISTRIBUTED_PORTSCAN_STR   "(portscan) IP Filtered Distributed Protocol Scan"
#define PSNG_IP_PORTSWEEP_FILTERED_STR   "(portscan) IP Filtered Protocol Sweep"
#define PSNG_UDP_PORTSCAN_STR   "(portscan) UDP Portscan"
#define PSNG_UDP_DECOY_PORTSCAN_STR   "(portscan) UDP Decoy Portscan"
#define PSNG_UDP_PORTSWEEP_STR   "(portscan) UDP Portsweep"
#define PSNG_UDP_DISTRIBUTED_PORTSCAN_STR   "(portscan) UDP Distributed Portscan"
#define PSNG_UDP_FILTERED_PORTSCAN_STR   "(portscan) UDP Filtered Portscan"
#define PSNG_UDP_FILTERED_DECOY_PORTSCAN_STR   "(portscan) UDP Filtered Decoy Portscan"
#define PSNG_UDP_FILTERED_DISTRIBUTED_PORTSCAN_STR   "(portscan) UDP Filtered Distributed Portscan"
#define PSNG_UDP_PORTSWEEP_FILTERED_STR   "(portscan) UDP Filtered Portsweep"
#define PSNG_ICMP_PORTSWEEP_STR   "(portscan) ICMP Sweep"
#define PSNG_ICMP_PORTSWEEP_FILTERED_STR   "(portscan) ICMP Filtered Sweep"
#define PSNG_OPEN_PORT_STR   "(portscan) Open Port"
#define CLAMAV_VIRUSFOUND_STR   "(spp_clamav) Virus Found:"


Define Documentation

#define ARPSPOOF_ARP_CACHE_OVERWRITE_ATTACK   4
 

Definition at line 106 of file generators.h.

Referenced by DetectARPattacks().

#define ARPSPOOF_ARP_CACHE_OVERWRITE_ATTACK_STR   "(spp_arpspoof) Attempted ARP cache overwrite attack"
 

Definition at line 267 of file generators.h.

Referenced by DetectARPattacks().

#define ARPSPOOF_ETHERFRAME_ARP_MISMATCH_DST   3
 

Definition at line 105 of file generators.h.

Referenced by DetectARPattacks().

#define ARPSPOOF_ETHERFRAME_ARP_MISMATCH_DST_STR   "(spp_arpspoof) Ethernet/ARP Mismatch request for Destination"
 

Definition at line 265 of file generators.h.

Referenced by DetectARPattacks().

#define ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC   2
 

Definition at line 104 of file generators.h.

Referenced by DetectARPattacks().

#define ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC_STR   "(spp_arpspoof) Ethernet/ARP Mismatch request for Source"
 

Definition at line 263 of file generators.h.

Referenced by DetectARPattacks().

#define ARPSPOOF_UNICAST_ARP_REQUEST   1
 

Definition at line 103 of file generators.h.

Referenced by DetectARPattacks().

#define ARPSPOOF_UNICAST_ARP_REQUEST_STR   "(spp_arpspoof) Unicast ARP request"
 

Definition at line 262 of file generators.h.

Referenced by DetectARPattacks().

#define ASN1_DATUM_BAD_LENGTH   5
 

Definition at line 128 of file generators.h.

#define ASN1_DATUM_BAD_LENGTH_STR   "(spp_asn1) ASN.1 Attack: Datum length > packet length"
 

Definition at line 274 of file generators.h.

#define ASN1_INDEFINITE_LENGTH   1
 

Definition at line 124 of file generators.h.

#define ASN1_INDEFINITE_LENGTH_STR   "(spp_asn1) Indefinite ASN.1 length encoding"
 

Definition at line 270 of file generators.h.

#define ASN1_INVALID_LENGTH   2
 

Definition at line 125 of file generators.h.

#define ASN1_INVALID_LENGTH_STR   "(spp_asn1) Invalid ASN.1 length encoding"
 

Definition at line 271 of file generators.h.

#define ASN1_OVERSIZED_ITEM   3
 

Definition at line 126 of file generators.h.

#define ASN1_OVERSIZED_ITEM_STR   "(spp_asn1) ASN.1 oversized item, possible overflow"
 

Definition at line 272 of file generators.h.

#define ASN1_SPEC_VIOLATION   4
 

Definition at line 127 of file generators.h.

#define ASN1_SPEC_VIOLATION_STR   "(spp_asn1) ASN.1 spec violation, possible overflow"
 

Definition at line 273 of file generators.h.

#define BO_CLIENT_TRAFFIC_DETECT   2
 

Definition at line 56 of file generators.h.

Referenced by BoFind().

#define BO_CLIENT_TRAFFIC_DETECT_STR   "(spo_bo) Back Orifice Client Traffic detected"
 

Definition at line 277 of file generators.h.

Referenced by BoFind().

#define BO_SERVER_TRAFFIC_DETECT   3
 

Definition at line 57 of file generators.h.

Referenced by BoFind().

#define BO_SERVER_TRAFFIC_DETECT_STR   "(spo_bo) Back Orifice Server Traffic detected"
 

Definition at line 278 of file generators.h.

Referenced by BoFind().

#define BO_SNORT_BUFFER_ATTACK   4
 

Definition at line 58 of file generators.h.

Referenced by BoGetDirection().

#define BO_SNORT_BUFFER_ATTACK_STR   "(spo_bo) Back Orifice Snort buffer attack"
 

Definition at line 279 of file generators.h.

Referenced by BoGetDirection().

#define BO_TRAFFIC_DETECT   1
 

Definition at line 55 of file generators.h.

Referenced by BoFind().

#define BO_TRAFFIC_DETECT_STR   "(spo_bo) Back Orifice Traffic detected"
 

Definition at line 276 of file generators.h.

Referenced by BoFind().

#define CLAMAV_VIRUSFOUND   1
 

Definition at line 255 of file generators.h.

#define CLAMAV_VIRUSFOUND_STR   "(spp_clamav) Virus Found:"
 

Definition at line 445 of file generators.h.

#define CONV_BAD_IP_PROTOCOL   1
 

Definition at line 181 of file generators.h.

Referenced by ConvFunc().

#define CONV_BAD_IP_PROTOCOL_STR   "(spp_conversation) Bad IP protocol!"
 

Definition at line 403 of file generators.h.

Referenced by ConvFunc().

#define DECODE_ARP_TRUNCATED   109
 

Definition at line 157 of file generators.h.

Referenced by DecodeARP().

#define DECODE_ARP_TRUNCATED_STR   "(snort_decoder) WARNING: Truncated ARP!"
 

Definition at line 379 of file generators.h.

Referenced by DecodeARP().

#define DECODE_BAD_80211_ETHLLC   133
 

Definition at line 166 of file generators.h.

Referenced by DecodeIEEE80211Pkt().

#define DECODE_BAD_80211_ETHLLC_STR   "(snort_decoder) WARNING: Bad 802.11 LLC header!"
 

Definition at line 387 of file generators.h.

Referenced by DecodeIEEE80211Pkt().

#define DECODE_BAD_80211_OTHER   134
 

Definition at line 167 of file generators.h.

#define DECODE_BAD_80211_OTHER_STR   "(snort_decoder) WARNING: Bad 802.11 Extra LLC Info!"
 

Definition at line 388 of file generators.h.

#define DECODE_BAD_PPPOE   120
 

Definition at line 162 of file generators.h.

Referenced by DecodePPPoEPkt().

#define DECODE_BAD_PPPOE_STR   "(snort_decoder) WARNING: Bad PPPOE frame detected!"
 

Definition at line 383 of file generators.h.

Referenced by DecodePPPoEPkt().

#define DECODE_BAD_TR_ETHLLC   141
 

Definition at line 170 of file generators.h.

Referenced by DecodeTRPkt().

#define DECODE_BAD_TR_ETHLLC_STR   "(snort_decoder) WARNING: Bad Token Ring ETHLLC Header!"
 

Definition at line 391 of file generators.h.

Referenced by DecodeTRPkt().

#define DECODE_BAD_TR_MR_LEN   142
 

Definition at line 171 of file generators.h.

Referenced by DecodeTRPkt().

#define DECODE_BAD_TR_MR_LEN_STR   "(snort_decoder) WARNING: Bad Token Ring MRLENHeader!"
 

Definition at line 392 of file generators.h.

Referenced by DecodeTRPkt().

#define DECODE_BAD_TRAFFIC_LOOPBACK   150
 

Definition at line 174 of file generators.h.

Referenced by IPHdrTests().

#define DECODE_BAD_TRAFFIC_LOOPBACK_STR   "(snort decoder) Bad Traffic Loopback IP"
 

Definition at line 396 of file generators.h.

Referenced by IPHdrTests().

#define DECODE_BAD_TRAFFIC_SAME_SRCDST   151
 

Definition at line 175 of file generators.h.

Referenced by IPHdrTests().

#define DECODE_BAD_TRAFFIC_SAME_SRCDST_STR   "(snort decoder) Bad Traffic Same Src/Dst IP"
 

Definition at line 397 of file generators.h.

Referenced by IPHdrTests().

#define DECODE_BAD_TRH   140
 

Definition at line 169 of file generators.h.

Referenced by DecodeTRPkt().

#define DECODE_BAD_TRH_STR   "(snort_decoder) WARNING: Bad Token Ring Header!"
 

Definition at line 390 of file generators.h.

Referenced by DecodeTRPkt().

#define DECODE_BAD_TRHMR   143
 

Definition at line 172 of file generators.h.

Referenced by DecodeTRPkt().

#define DECODE_BAD_TRHMR_STR   "(snort_decoder) WARNING: Bad Token Ring MR Header!"
 

Definition at line 393 of file generators.h.

Referenced by DecodeTRPkt().

#define DECODE_BAD_VLAN   130
 

Definition at line 163 of file generators.h.

Referenced by DecodeVlan().

#define DECODE_BAD_VLAN_ETHLLC   131
 

Definition at line 164 of file generators.h.

Referenced by DecodeVlan().

#define DECODE_BAD_VLAN_ETHLLC_STR   "(snort_decoder) WARNING: Bad LLC header!"
 

Definition at line 385 of file generators.h.

Referenced by DecodeVlan().

#define DECODE_BAD_VLAN_OTHER   132
 

Definition at line 165 of file generators.h.

Referenced by DecodeVlan().

#define DECODE_BAD_VLAN_OTHER_STR   "(snort_decoder) WARNING: Bad Extra LLC Info!"
 

Definition at line 386 of file generators.h.

Referenced by DecodeVlan().

#define DECODE_BAD_VLAN_STR   "(snort_decoder) WARNING: Bad VLAN Frame!"
 

Definition at line 384 of file generators.h.

Referenced by DecodeVlan().

#define DECODE_EAP_TRUNCATED   112
 

Definition at line 160 of file generators.h.

Referenced by DecodeEAP().

#define DECODE_EAP_TRUNCATED_STR   "(snort_decoder) WARNING: EAP Header Truncated!"
 

Definition at line 382 of file generators.h.

Referenced by DecodeEAP().

#define DECODE_EAPKEY_TRUNCATED   111
 

Definition at line 159 of file generators.h.

Referenced by DecodeEapolKey().

#define DECODE_EAPKEY_TRUNCATED_STR   "(snort_decoder) WARNING: EAP Key Truncated!"
 

Definition at line 381 of file generators.h.

Referenced by DecodeEapolKey().

#define DECODE_EAPOL_TRUNCATED   110
 

Definition at line 158 of file generators.h.

Referenced by DecodeEapol().

#define DECODE_EAPOL_TRUNCATED_STR   "(snort_decoder) WARNING: Truncated EAP Header!"
 

Definition at line 380 of file generators.h.

Referenced by DecodeEapol().

#define DECODE_ICMP_DGRAM_LT_ADDRHDR   107
 

Definition at line 154 of file generators.h.

Referenced by DecodeICMP().

#define DECODE_ICMP_DGRAM_LT_ADDRHDR_STR   "(snort_decoder) WARNING: ICMP Address Header Truncated!"
 

Definition at line 377 of file generators.h.

Referenced by DecodeICMP().

#define DECODE_ICMP_DGRAM_LT_ICMPHDR   105
 

Definition at line 152 of file generators.h.

Referenced by DecodeICMP().

#define DECODE_ICMP_DGRAM_LT_ICMPHDR_STR   "(snort_decoder) WARNING: ICMP Header Truncated!"
 

Definition at line 375 of file generators.h.

Referenced by DecodeICMP().

#define DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR   106
 

Definition at line 153 of file generators.h.

Referenced by DecodeICMP().

#define DECODE_ICMP_DGRAM_LT_TIMESTAMPHDR_STR   "(snort_decoder) WARNING: ICMP Timestamp Header Truncated!"
 

Definition at line 376 of file generators.h.

Referenced by DecodeICMP().

#define DECODE_IPV4_DGRAM_LT_IPHDR   3
 

Definition at line 134 of file generators.h.

Referenced by DecodeIP().

#define DECODE_IPV4_DGRAM_LT_IPHDR_STR   "(snort_decoder) WARNING: IP dgm len < IP Hdr len!"
 

Definition at line 355 of file generators.h.

Referenced by DecodeIP().

#define DECODE_IPV4_DGRAM_UNKNOWN   108
 

Definition at line 155 of file generators.h.

Referenced by DecodeICMP().

#define DECODE_IPV4_DGRAM_UNKNOWN_STR   "(snort_decoder) Unknown Datagram decoding problem!"
 

Definition at line 378 of file generators.h.

Referenced by DecodeICMP().

#define DECODE_IPV4_INVALID_HEADER_LEN   2
 

Definition at line 133 of file generators.h.

Referenced by DecodeIP().

#define DECODE_IPV4_INVALID_HEADER_LEN_STR   "(snort_decoder) WARNING: hlen < IP_HEADER_LEN!"
 

Definition at line 354 of file generators.h.

Referenced by DecodeIP().

#define DECODE_IPV4OPT_BADLEN   4
 

Definition at line 135 of file generators.h.

Referenced by DecodeIPOptions().

#define DECODE_IPV4OPT_BADLEN_STR   "(snort_decoder): Ipv4 Options found with bad lengths"
 

Definition at line 356 of file generators.h.

Referenced by DecodeIPOptions().

#define DECODE_IPV4OPT_TRUNCATED   5
 

Definition at line 136 of file generators.h.

Referenced by DecodeIPOptions().

#define DECODE_IPV4OPT_TRUNCATED_STR   "(snort_decoder): Truncated Ipv4 Options"
 

Definition at line 357 of file generators.h.

Referenced by DecodeIPOptions().

#define DECODE_NOT_IPV4_DGRAM   1
 

Definition at line 132 of file generators.h.

Referenced by DecodeIP().

#define DECODE_NOT_IPV4_DGRAM_STR   "(snort_decoder) WARNING: Not IPv4 datagram!"
 

Definition at line 353 of file generators.h.

Referenced by DecodeIP().

#define DECODE_TCP_DGRAM_LT_TCPHDR   45
 

Definition at line 138 of file generators.h.

Referenced by DecodeTCP().

#define DECODE_TCP_DGRAM_LT_TCPHDR_STR   "(snort_decoder) TCP packet len is smaller than 20 bytes!"
 

Definition at line 359 of file generators.h.

Referenced by DecodeTCP().

#define DECODE_TCP_INVALID_OFFSET   46
 

Definition at line 139 of file generators.h.

Referenced by DecodeTCP().

#define DECODE_TCP_INVALID_OFFSET_STR   "(snort_decoder) WARNING: TCP Data Offset is less than 5!"
 

Definition at line 360 of file generators.h.

Referenced by DecodeTCP().

#define DECODE_TCP_LARGE_OFFSET   47
 

Definition at line 140 of file generators.h.

Referenced by DecodeTCP().

#define DECODE_TCP_LARGE_OFFSET_STR   "(snort_decoder) WARNING: TCP Header length exceeds packet length!"
 

Definition at line 361 of file generators.h.

Referenced by DecodeTCP().

#define DECODE_TCPOPT_BADLEN   54
 

Definition at line 142 of file generators.h.

Referenced by DecodeTCPOptions().

#define DECODE_TCPOPT_BADLEN_STR   "(snort_decoder): Tcp Options found with bad lengths"
 

Definition at line 363 of file generators.h.

Referenced by DecodeTCPOptions().

#define DECODE_TCPOPT_EXPERIMENT   58
 

Definition at line 146 of file generators.h.

Referenced by DecodeTCPOptions().

#define DECODE_TCPOPT_EXPERIMENT_STR   "(snort_decoder): Experimental Tcp Options found"
 

Definition at line 367 of file generators.h.

Referenced by DecodeTCPOptions().

#define DECODE_TCPOPT_OBSOLETE   57
 

Definition at line 145 of file generators.h.

Referenced by DecodeTCPOptions().

#define DECODE_TCPOPT_OBSOLETE_STR   "(snort_decoder): Obsolete TCP Options found"
 

Definition at line 366 of file generators.h.

Referenced by DecodeTCPOptions().

#define DECODE_TCPOPT_TRUNCATED   55
 

Definition at line 143 of file generators.h.

Referenced by DecodeTCPOptions().

#define DECODE_TCPOPT_TRUNCATED_STR   "(snort_decoder): Truncated Tcp Options"
 

Definition at line 364 of file generators.h.

Referenced by DecodeTCPOptions().

#define DECODE_TCPOPT_TTCP   56
 

Definition at line 144 of file generators.h.

Referenced by DecodeTCPOptions().

#define DECODE_TCPOPT_TTCP_STR   "(snort_decoder): T/TCP Detected"
 

Definition at line 365 of file generators.h.

Referenced by DecodeTCPOptions().

#define DECODE_UDP_DGRAM_INVALID_LENGTH   96
 

Definition at line 149 of file generators.h.

Referenced by DecodeUDP().

#define DECODE_UDP_DGRAM_INVALID_LENGTH_STR   "(snort_decoder): Invalid UDP header, length field < 8"
 

Definition at line 372 of file generators.h.

Referenced by DecodeUDP().

#define DECODE_UDP_DGRAM_LT_UDPHDR   95
 

Definition at line 148 of file generators.h.

Referenced by DecodeUDP().

#define DECODE_UDP_DGRAM_LT_UDPHDR_STR   "(snort_decoder) WARNING: Truncated UDP Header!"
 

Definition at line 371 of file generators.h.

Referenced by DecodeUDP().

#define DECODE_UDP_DGRAM_SHORT_PACKET   97
 

Definition at line 150 of file generators.h.

Referenced by DecodeUDP().

#define DECODE_UDP_DGRAM_SHORT_PACKET_STR   "(snort_decoder): Short UDP packet, length field > payload length"
 

Definition at line 373 of file generators.h.

Referenced by DecodeUDP().

#define DEFRAG_FRAG_OVERFLOW   1
 

Definition at line 47 of file generators.h.

#define DEFRAG_FRAGS_DISCARDED   2
 

Definition at line 48 of file generators.h.

#define FLOW_SCANNER_FIXED_ALERT   1
 

Definition at line 216 of file generators.h.

Referenced by flowps_generate_flow_event().

#define FLOW_SCANNER_SLIDING_ALERT   2
 

Definition at line 217 of file generators.h.

Referenced by flowps_generate_flow_event().

#define FLOW_TALKER_FIXED_ALERT   3
 

Definition at line 218 of file generators.h.

Referenced by flowps_generate_flow_event().

#define FLOW_TALKER_SLIDING_ALERT   4
 

Definition at line 219 of file generators.h.

Referenced by flowps_generate_flow_event().

#define FNORD_NOPSLED   1
 

Definition at line 121 of file generators.h.

#define FNORD_NOPSLED_HPPA_STR   "(spp_fnord) Possible Mutated HPPA NOP Sled detected"
 

Definition at line 282 of file generators.h.

#define FNORD_NOPSLED_IA32_STR   "(spp_fnord) Possible Mutated IA32 NOP Sled detected"
 

Definition at line 281 of file generators.h.

#define FNORD_NOPSLED_SPARC_STR   "(spp_fnord) Possible Mutated SPARC NOP Sled detected"
 

Definition at line 283 of file generators.h.

#define FRAG2_DUPFIRST   5
 

Definition at line 113 of file generators.h.

Referenced by InsertFrag().

#define FRAG2_DUPFIRST_STR   "(spp_frag2) Duplicate first fragments"
 

Definition at line 285 of file generators.h.

Referenced by InsertFrag().

#define FRAG2_EMERGENCY   9
 

Definition at line 117 of file generators.h.

Referenced by Frag2Defrag().

#define FRAG2_EMERGENCY_STR   "(spp_frag2) Shifting to Emergency Session Mode"
 

Definition at line 292 of file generators.h.

Referenced by Frag2Defrag().

#define FRAG2_IPOPTIONS   8
 

Definition at line 116 of file generators.h.

Referenced by Frag2Defrag().

#define FRAG2_IPOPTIONS_STR   "(spp_frag2) IP Options on Fragmented Packet"
 

Definition at line 286 of file generators.h.

Referenced by Frag2Defrag().

#define FRAG2_MEM_EXCEED   6
 

Definition at line 114 of file generators.h.

#define FRAG2_OUTOFORDER   7
 

Definition at line 115 of file generators.h.

Referenced by Frag2Defrag().

#define FRAG2_OUTOFORDER_STR   "(spp_frag2) Out of order fragments"
 

Definition at line 287 of file generators.h.

Referenced by Frag2Defrag().

#define FRAG2_OVERLAP   4
 

Definition at line 112 of file generators.h.

Referenced by InsertFrag().

#define FRAG2_OVERLAP_STR   "(spp_frag2) Overlapping new fragment (probable fragroute)"
 

Definition at line 288 of file generators.h.

Referenced by InsertFrag().

#define FRAG2_OVERSIZE_FRAG   1
 

Definition at line 109 of file generators.h.

Referenced by InsertFrag().

#define FRAG2_OVERSIZE_FRAG_STR   "(spp_frag2) Oversized fragment, probable DoS"
 

Definition at line 289 of file generators.h.

Referenced by InsertFrag().

#define FRAG2_SUSPEND   10
 

Definition at line 118 of file generators.h.

Referenced by Frag2Defrag().

#define FRAG2_SUSPEND_STR   "(spp_frag2) Shifting to Suspend Mode"
 

Definition at line 293 of file generators.h.

Referenced by Frag2Defrag().

#define FRAG2_TEARDROP   2
 

Definition at line 110 of file generators.h.

Referenced by Frag2Defrag().

#define FRAG2_TEARDROP_STR   "(spp_frag2) Teardrop attack"
 

Definition at line 290 of file generators.h.

Referenced by Frag2Defrag().

#define FRAG2_TTL_EVASION   3
 

Definition at line 111 of file generators.h.

Referenced by Frag2Defrag().

#define FRAG2_TTL_EVASION_STR   "(spp_frag2) TTL Limit Exceeded (reassemble) detection"
 

Definition at line 291 of file generators.h.

Referenced by Frag2Defrag().

#define FRAG3_ANOM_BADSIZE_LG_STR   "(spp_frag3) Bad fragment size, packet size is greater than 65536"
 

Definition at line 349 of file generators.h.

Referenced by EventAnomBadsizeLg().

#define FRAG3_ANOM_BADSIZE_SM_STR   "(spp_frag3) Bad fragment size, packet size is negative"
 

Definition at line 348 of file generators.h.

Referenced by EventAnomBadsizeSm().

#define FRAG3_ANOM_OVERSIZE_STR   "(spp_frag3) Fragment packet ends after defragmented packet"
 

Definition at line 346 of file generators.h.

Referenced by EventAnomOversize().

#define FRAG3_ANOM_OVLP_STR   "(spp_frag3) Fragmentation overlap"
 

Definition at line 350 of file generators.h.

Referenced by EventAnomOverlap().

#define FRAG3_ANOM_ZERO_STR   "(spp_frag3) Zero-byte fragment packet"
 

Definition at line 347 of file generators.h.

Referenced by EventAnomZeroFrag().

#define FRAG3_ANOMALY_BADSIZE_LG   7
 

Definition at line 302 of file generators.h.

Referenced by EventAnomBadsizeLg().

#define FRAG3_ANOMALY_BADSIZE_SM   6
 

Definition at line 301 of file generators.h.

Referenced by EventAnomBadsizeSm().

#define FRAG3_ANOMALY_OVERSIZE   4
 

Definition at line 299 of file generators.h.

Referenced by EventAnomOversize().

#define FRAG3_ANOMALY_OVLP   8
 

Definition at line 303 of file generators.h.

Referenced by EventAnomOverlap().

#define FRAG3_ANOMALY_ZERO   5
 

Definition at line 300 of file generators.h.

Referenced by EventAnomZeroFrag().

#define FRAG3_IPOPTIONS   1
 

Definition at line 296 of file generators.h.

Referenced by EventAnomIpOpts().

#define FRAG3_IPOPTIONS_STR   "(spp_frag3) Inconsistent IP Options on Fragmented Packets"
 

Definition at line 343 of file generators.h.

Referenced by EventAnomIpOpts().

#define FRAG3_SHORT_FRAG   3
 

Definition at line 298 of file generators.h.

Referenced by EventAnomShortFrag().

#define FRAG3_SHORT_FRAG_STR   "(spp_frag3) Short fragment, possible DoS attempt"
 

Definition at line 345 of file generators.h.

Referenced by EventAnomShortFrag().

#define FRAG3_TEARDROP   2
 

Definition at line 297 of file generators.h.

Referenced by EventAttackTeardrop().

#define FRAG3_TEARDROP_STR   "(spp_frag3) Teardrop attack"
 

Definition at line 344 of file generators.h.

Referenced by EventAttackTeardrop().

#define GENERATOR_FLOW_PORTSCAN   121
 

Definition at line 215 of file generators.h.

Referenced by flowps_generate_flow_event().

#define GENERATOR_PSNG   122
 

Definition at line 221 of file generators.h.

Referenced by PortscanAlert(), PortscanAlertIcmp(), PortscanAlertIp(), PortscanAlertTcp(), and PortscanAlertUdp().

#define GENERATOR_SMTP   124
 

Definition at line 257 of file generators.h.

Referenced by ParseXLink2State().

#define GENERATOR_SNORT_DECODE   116
 

Definition at line 131 of file generators.h.

Referenced by DecodeARP(), DecodeEAP(), DecodeEapol(), DecodeEapolKey(), DecodeICMP(), DecodeIEEE80211Pkt(), DecodeIP(), DecodeIPOptions(), DecodePPPoEPkt(), DecodeTCP(), DecodeTCPOptions(), DecodeTRPkt(), DecodeUDP(), DecodeVlan(), and IPHdrTests().

#define GENERATOR_SNORT_ENGINE   1
 

Definition at line 23 of file generators.h.

Referenced by ParseRuleOptions().

#define GENERATOR_SPP_ARPSPOOF   112
 

Definition at line 102 of file generators.h.

Referenced by DetectARPattacks().

#define GENERATOR_SPP_ASN1   115
 

Definition at line 123 of file generators.h.

#define GENERATOR_SPP_BO   105
 

Definition at line 54 of file generators.h.

Referenced by BoFind(), and BoGetDirection().

#define GENERATOR_SPP_CLAMAV   123
 

Definition at line 254 of file generators.h.

#define GENERATOR_SPP_CONV   118
 

Definition at line 180 of file generators.h.

Referenced by ConvFunc().

#define GENERATOR_SPP_DEFRAG   103
 

Definition at line 46 of file generators.h.

#define GENERATOR_SPP_FNORD   114
 

Definition at line 120 of file generators.h.

#define GENERATOR_SPP_FRAG2   113
 

Definition at line 108 of file generators.h.

Referenced by Frag2Defrag(), and InsertFrag().

#define GENERATOR_SPP_FRAG3   123
 

Definition at line 295 of file generators.h.

Referenced by EventAnomBadsizeLg(), EventAnomBadsizeSm(), EventAnomIpOpts(), EventAnomOverlap(), EventAnomOversize(), EventAnomShortFrag(), EventAnomZeroFrag(), and EventAttackTeardrop().

#define GENERATOR_SPP_HTTP_DECODE   102
 

Definition at line 36 of file generators.h.

#define GENERATOR_SPP_HTTP_INSPECT_ANOM_SERVER   120
 

Definition at line 212 of file generators.h.

Referenced by LogEvents().

#define GENERATOR_SPP_HTTP_INSPECT_CLIENT   119
 

Definition at line 192 of file generators.h.

Referenced by LogEvents().

#define GENERATOR_SPP_MINFRAG   101
 

Definition at line 33 of file generators.h.

#define GENERATOR_SPP_PORTSCAN   100
 

Definition at line 28 of file generators.h.

Referenced by AlertIntermediateInfo(), and PortscanPreprocFunction().

#define GENERATOR_SPP_RPC_DECODE   106
 

Definition at line 60 of file generators.h.

Referenced by PreprocRpcDecode().

#define GENERATOR_SPP_SCAN2   117
 

Definition at line 177 of file generators.h.

Referenced by SAlert().

#define GENERATOR_SPP_SPADE   104
 

Definition at line 50 of file generators.h.

#define GENERATOR_SPP_STREAM2   107
 

Definition at line 67 of file generators.h.

#define GENERATOR_SPP_STREAM3   108
 

Definition at line 68 of file generators.h.

#define GENERATOR_SPP_STREAM4   111
 

Definition at line 77 of file generators.h.

Referenced by CheckRst(), CreateNewSession(), ReassembleStream4(), StoreStreamPkt(), TcpAction(), and TcpActionAsync().

#define GENERATOR_SPP_TELNET_NEG   109
 

Definition at line 69 of file generators.h.

#define GENERATOR_SPP_UNIDECODE   110
 

Definition at line 71 of file generators.h.

#define GENERATOR_TAG   2
 

Definition at line 25 of file generators.h.

Referenced by CheckTagList(), OldUnifiedLogPacketAlert(), and RealUnifiedLogStreamAlert().

#define HI_ANOM_SERVER_ALERT   1
 

Definition at line 213 of file generators.h.

#define HI_CLIENT_APACHE_WS   12
 

Definition at line 204 of file generators.h.

#define HI_CLIENT_ASCII   1
 

Definition at line 193 of file generators.h.

#define HI_CLIENT_BARE_BYTE   4
 

Definition at line 196 of file generators.h.

#define HI_CLIENT_BASE36   5
 

Definition at line 197 of file generators.h.

#define HI_CLIENT_DIR_TRAV   11
 

Definition at line 203 of file generators.h.

#define HI_CLIENT_DOUBLE_DECODE   2
 

Definition at line 194 of file generators.h.

#define HI_CLIENT_IIS_BACKSLASH   9
 

Definition at line 201 of file generators.h.

#define HI_CLIENT_IIS_DELIMITER   13
 

Definition at line 205 of file generators.h.

#define HI_CLIENT_IIS_UNICODE   7
 

Definition at line 199 of file generators.h.

#define HI_CLIENT_LARGE_CHUNK   16
 

Definition at line 208 of file generators.h.

#define HI_CLIENT_MULTI_SLASH   8
 

Definition at line 200 of file generators.h.

#define HI_CLIENT_NON_RFC_CHAR   14
 

Definition at line 206 of file generators.h.

#define HI_CLIENT_OVERSIZE_DIR   15
 

Definition at line 207 of file generators.h.

#define HI_CLIENT_PROXY_USE   17
 

Definition at line 209 of file generators.h.

#define HI_CLIENT_SELF_DIR_TRAV   10
 

Definition at line 202 of file generators.h.

#define HI_CLIENT_U_ENCODE   3
 

Definition at line 195 of file generators.h.

#define HI_CLIENT_UTF_8   6
 

Definition at line 198 of file generators.h.

#define HI_CLIENT_WEBROOT_DIR   18
 

Definition at line 210 of file generators.h.

#define HTTP_DECODE_CGINULL_ATTACK   2
 

Definition at line 38 of file generators.h.

#define HTTP_DECODE_DOUBLE_ENC   5
 

Definition at line 41 of file generators.h.

#define HTTP_DECODE_DOUBLE_ENC_STR   "(spp_http_decode) Double Hex Encoding Received"
 

Definition at line 310 of file generators.h.

#define HTTP_DECODE_ILLEGAL_HEX   6
 

Definition at line 42 of file generators.h.

#define HTTP_DECODE_ILLEGAL_HEX_STR   "(spp_http_decode) Illegal URL hex encoding"
 

Definition at line 311 of file generators.h.

#define HTTP_DECODE_LARGE_METHOD   3
 

Definition at line 39 of file generators.h.

#define HTTP_DECODE_LARGE_METHOD_STR   "(spp_http_decode) A large HTTP method was received"
 

Definition at line 308 of file generators.h.

#define HTTP_DECODE_MISSING_URI   4
 

Definition at line 40 of file generators.h.

#define HTTP_DECODE_MISSING_URI_STR   "(spp_http_decode) HTTP request without URI"
 

Definition at line 309 of file generators.h.

#define HTTP_DECODE_OVERLONG_CHAR   7
 

Definition at line 43 of file generators.h.

#define HTTP_DECODE_OVERLONG_CHAR_STR   "(spp_http_decode) Overlong Unicode character received"
 

Definition at line 312 of file generators.h.

#define HTTP_DECODE_UNICODE_ATTACK   1
 

Definition at line 37 of file generators.h.

#define MINFRAG_ALERT_ID   1
 

Definition at line 34 of file generators.h.

#define PORTSCAN_INTER_INFO   2
 

Definition at line 30 of file generators.h.

Referenced by AlertIntermediateInfo().

#define PORTSCAN_SCAN_DETECT   1
 

Definition at line 29 of file generators.h.

Referenced by PortscanPreprocFunction().

#define PORTSCAN_SCAN_END   3
 

Definition at line 31 of file generators.h.

Referenced by PortscanPreprocFunction().

#define PSNG_ICMP_PORTSWEEP   25
 

Definition at line 249 of file generators.h.

Referenced by PortscanAlertIcmp().

#define PSNG_ICMP_PORTSWEEP_FILTERED   26
 

Definition at line 250 of file generators.h.

Referenced by PortscanAlertIcmp().

#define PSNG_ICMP_PORTSWEEP_FILTERED_STR   "(portscan) ICMP Filtered Sweep"
 

Definition at line 441 of file generators.h.

Referenced by PortscanAlertIcmp().

#define PSNG_ICMP_PORTSWEEP_STR   "(portscan) ICMP Sweep"
 

Definition at line 440 of file generators.h.

Referenced by PortscanAlertIcmp().

#define PSNG_IP_DECOY_PORTSCAN   10
 

Definition at line 232 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_DECOY_PORTSCAN_STR   "(portscan) IP Decoy Protocol Scan"
 

Definition at line 423 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_DISTRIBUTED_PORTSCAN   12
 

Definition at line 234 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_DISTRIBUTED_PORTSCAN_STR   "(portscan) IP Distributed Protocol Scan"
 

Definition at line 425 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_FILTERED_DECOY_PORTSCAN   14
 

Definition at line 236 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_FILTERED_DECOY_PORTSCAN_STR   "(portscan) IP Filtered Decoy Protocol Scan"
 

Definition at line 427 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_FILTERED_DISTRIBUTED_PORTSCAN   16
 

Definition at line 238 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_FILTERED_DISTRIBUTED_PORTSCAN_STR   "(portscan) IP Filtered Distributed Protocol Scan"
 

Definition at line 428 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_FILTERED_PORTSCAN   13
 

Definition at line 235 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_FILTERED_PORTSCAN_STR   "(portscan) IP Filtered Protocol Scan"
 

Definition at line 426 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_PORTSCAN   9
 

Definition at line 231 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_PORTSCAN_STR   "(portscan) IP Protocol Scan"
 

Definition at line 422 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_PORTSWEEP   11
 

Definition at line 233 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_PORTSWEEP_FILTERED   15
 

Definition at line 237 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_PORTSWEEP_FILTERED_STR   "(portscan) IP Filtered Protocol Sweep"
 

Definition at line 429 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_IP_PORTSWEEP_STR   "(portscan) IP Protocol Sweep"
 

Definition at line 424 of file generators.h.

Referenced by PortscanAlertIp().

#define PSNG_OPEN_PORT   27
 

Definition at line 252 of file generators.h.

Referenced by PortscanAlert(), and PortscanAlertTcp().

#define PSNG_OPEN_PORT_STR   "(portscan) Open Port"
 

Definition at line 443 of file generators.h.

Referenced by PortscanAlert(), and PortscanAlertTcp().

#define PSNG_TCP_DECOY_PORTSCAN   2
 

Definition at line 223 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_DECOY_PORTSCAN_STR   "(portscan) TCP Decoy Portscan"
 

Definition at line 414 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_DISTRIBUTED_PORTSCAN   4
 

Definition at line 225 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_DISTRIBUTED_PORTSCAN_STR   "(portscan) TCP Distributed Portscan"
 

Definition at line 416 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_FILTERED_DECOY_PORTSCAN   6
 

Definition at line 227 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_FILTERED_DECOY_PORTSCAN_STR   "(portscan) TCP Filtered Decoy Portscan"
 

Definition at line 418 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_FILTERED_DISTRIBUTED_PORTSCAN   8
 

Definition at line 229 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_FILTERED_DISTRIBUTED_PORTSCAN_STR   "(portscan) TCP Filtered Distributed Portscan"
 

Definition at line 419 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_FILTERED_PORTSCAN   5
 

Definition at line 226 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_FILTERED_PORTSCAN_STR   "(portscan) TCP Filtered Portscan"
 

Definition at line 417 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_PORTSCAN   1
 

Definition at line 222 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_PORTSCAN_STR   "(portscan) TCP Portscan"
 

Definition at line 413 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_PORTSWEEP   3
 

Definition at line 224 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_PORTSWEEP_FILTERED   7
 

Definition at line 228 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_PORTSWEEP_FILTERED_STR   "(portscan) TCP Filtered Portsweep"
 

Definition at line 420 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_TCP_PORTSWEEP_STR   "(portscan) TCP Portsweep"
 

Definition at line 415 of file generators.h.

Referenced by PortscanAlertTcp().

#define PSNG_UDP_DECOY_PORTSCAN   18
 

Definition at line 241 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_DECOY_PORTSCAN_STR   "(portscan) UDP Decoy Portscan"
 

Definition at line 432 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_DISTRIBUTED_PORTSCAN   20
 

Definition at line 243 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_DISTRIBUTED_PORTSCAN_STR   "(portscan) UDP Distributed Portscan"
 

Definition at line 434 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_FILTERED_DECOY_PORTSCAN   22
 

Definition at line 245 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_FILTERED_DECOY_PORTSCAN_STR   "(portscan) UDP Filtered Decoy Portscan"
 

Definition at line 436 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_FILTERED_DISTRIBUTED_PORTSCAN   24
 

Definition at line 247 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_FILTERED_DISTRIBUTED_PORTSCAN_STR   "(portscan) UDP Filtered Distributed Portscan"
 

Definition at line 437 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_FILTERED_PORTSCAN   21
 

Definition at line 244 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_FILTERED_PORTSCAN_STR   "(portscan) UDP Filtered Portscan"
 

Definition at line 435 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_PORTSCAN   17
 

Definition at line 240 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_PORTSCAN_STR   "(portscan) UDP Portscan"
 

Definition at line 431 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_PORTSWEEP   19
 

Definition at line 242 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_PORTSWEEP_FILTERED   23
 

Definition at line 246 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_PORTSWEEP_FILTERED_STR   "(portscan) UDP Filtered Portsweep"
 

Definition at line 438 of file generators.h.

Referenced by PortscanAlertUdp().

#define PSNG_UDP_PORTSWEEP_STR   "(portscan) UDP Portsweep"
 

Definition at line 433 of file generators.h.

Referenced by PortscanAlertUdp().

#define RPC_FRAG_TRAFFIC   1
 

Definition at line 61 of file generators.h.

Referenced by ConvertRPC(), and PreprocRpcDecode().

#define RPC_FRAG_TRAFFIC_STR   "(spp_rpc_decode) Fragmented RPC Records"
 

Definition at line 406 of file generators.h.

Referenced by PreprocRpcDecode().

#define RPC_INCOMPLETE_SEGMENT   4
 

Definition at line 64 of file generators.h.

Referenced by ConvertRPC(), and PreprocRpcDecode().

#define RPC_INCOMPLETE_SEGMENT_STR   "(spp_rpc_decode) Incomplete RPC segment"
 

Definition at line 409 of file generators.h.

Referenced by PreprocRpcDecode().

#define RPC_LARGE_FRAGSIZE   3
 

Definition at line 63 of file generators.h.

Referenced by ConvertRPC(), and PreprocRpcDecode().

#define RPC_LARGE_FRAGSIZE_STR   "(spp_rpc_decode) Large RPC Record Fragment"
 

Definition at line 408 of file generators.h.

Referenced by PreprocRpcDecode().

#define RPC_MULTIPLE_RECORD   2
 

Definition at line 62 of file generators.h.

Referenced by ConvertRPC(), and PreprocRpcDecode().

#define RPC_MULTIPLE_RECORD_STR   "(spp_rpc_decode) Multiple RPC Records"
 

Definition at line 407 of file generators.h.

Referenced by PreprocRpcDecode().

#define RPC_ZERO_LENGTH_FRAGMENT   5
 

Definition at line 65 of file generators.h.

Referenced by ConvertRPC(), and PreprocRpcDecode().

#define RPC_ZERO_LENGTH_FRAGMENT_STR   "(spp_rpc_decode) Zero-length RPC Fragment"
 

Definition at line 410 of file generators.h.

Referenced by PreprocRpcDecode().

#define SCAN2_PREFIX_STR   "(spp_portscan2) Portscan detected from "
 

Definition at line 400 of file generators.h.

Referenced by SAlert().

#define SCAN_TYPE   1
 

Definition at line 178 of file generators.h.

Referenced by SAlert().

#define SPADE_ANOM_THRESHOLD_ADJUSTED   2
 

Definition at line 52 of file generators.h.

#define SPADE_ANOM_THRESHOLD_EXCEEDED   1
 

Definition at line 51 of file generators.h.

#define STREAM4_DATA_ON_SYN   5
 

Definition at line 82 of file generators.h.

Referenced by TcpAction(), and TcpActionAsync().

#define STREAM4_DATA_ON_SYN_STR   "(spp_stream4) DATA ON SYN detection"
 

Definition at line 317 of file generators.h.

Referenced by TcpAction(), and TcpActionAsync().

#define STREAM4_EMERGENCY   19
 

Definition at line 96 of file generators.h.

Referenced by ReassembleStream4().

#define STREAM4_EMERGENCY_STR   "(spp_stream4) Shifting to Emergency Session Mode"
 

Definition at line 336 of file generators.h.

Referenced by ReassembleStream4().

#define STREAM4_EVASIVE_RETRANS   3
 

Definition at line 80 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_EVASIVE_RETRANS_DATA   16
 

Definition at line 93 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_EVASIVE_RETRANS_DATA_STR   "(spp_stream4) TCP CHECKSUM CHANGED ON RETRANSMISSION (possible fragroute) detection"
 

Definition at line 331 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_EVASIVE_RETRANS_DATASPLIT   17
 

Definition at line 94 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_EVASIVE_RETRANS_DATASPLIT_STR   "(spp_stream4) TCP TOO FAST RETRANSMISSION WITH DIFFERENT DATA SIZE (possible fragroute) detection"
 

Definition at line 334 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_EVASIVE_RETRANS_STR   "(spp_stream4) Possible RETRANSMISSION detection"
 

Definition at line 329 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_EVASIVE_RST   2
 

Definition at line 79 of file generators.h.

Referenced by CheckRst().

#define STREAM4_EVASIVE_RST_STR   "(spp_stream4) possible EVASIVE RST detection"
 

Definition at line 327 of file generators.h.

Referenced by CheckRst().

#define STREAM4_FORWARD_OVERLAP   14
 

Definition at line 91 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_FORWARD_OVERLAP_STR   "(spp_stream4) FORWARD OVERLAP detection"
 

Definition at line 333 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_MULTIPLE_ACKED   18
 

Definition at line 95 of file generators.h.

#define STREAM4_MULTIPLE_ACKED_STR   "(spp_stream4) Multiple Acked Packets (possible fragroute)"
 

Definition at line 316 of file generators.h.

#define STREAM4_OVERLAP_LIMIT   22
 

Definition at line 99 of file generators.h.

Referenced by ReassembleStream4().

#define STREAM4_OVERLAP_LIMIT_STR   "(spp_stream4) TCP stream too many overlapping packets"
 

Definition at line 339 of file generators.h.

Referenced by ReassembleStream4().

#define STREAM4_STEALTH_ACTIVITY   1
 

Definition at line 78 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_ACTIVITY_STR   "(spp_stream4) STEALTH ACTIVITY (unknown) detection"
 

Definition at line 326 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_FIN_SCAN   8
 

Definition at line 85 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_FIN_SCAN_STR   "(spp_stream4) STEALTH ACTIVITY (FIN scan) detection"
 

Definition at line 321 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_FULL_XMAS   6
 

Definition at line 83 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_FULL_XMAS_STR   "(spp_stream4) STEALTH ACTIVITY (Full XMAS scan) detection"
 

Definition at line 319 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_NMAP_FINGERPRINT   12
 

Definition at line 89 of file generators.h.

Referenced by TcpAction(), and TcpActionAsync().

#define STREAM4_STEALTH_NMAP_FINGERPRINT_STR   "(spp_stream4) NMAP FINGERPRINT (stateful) detection"
 

Definition at line 318 of file generators.h.

Referenced by TcpAction(), and TcpActionAsync().

#define STREAM4_STEALTH_NMAP_XMAS_SCAN   10
 

Definition at line 87 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_NMAP_XMAS_SCAN_STR   "(spp_stream4) STEALTH ACTIVITY (XMAS scan) detection"
 

Definition at line 324 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_NULL_SCAN   9
 

Definition at line 86 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_NULL_SCAN_STR   "(spp_stream4) STEALTH ACTIVITY (NULL scan) detection"
 

Definition at line 323 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_SAPU   7
 

Definition at line 84 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_SAPU_STR   "(spp_stream4) STEALTH ACTIVITY (SAPU scan) detection"
 

Definition at line 320 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_SYN_FIN_SCAN   13
 

Definition at line 90 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_SYN_FIN_SCAN_STR   "(spp_stream4) STEALTH ACTIVITY (SYN FIN scan) detection"
 

Definition at line 322 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_VECNA_SCAN   11
 

Definition at line 88 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_STEALTH_VECNA_SCAN_STR   "(spp_stream4) STEALTH ACTIVITY (Vecna scan) detection"
 

Definition at line 325 of file generators.h.

Referenced by CreateNewSession().

#define STREAM4_SUSPEND   20
 

Definition at line 97 of file generators.h.

Referenced by ReassembleStream4().

#define STREAM4_SUSPEND_STR   "(spp_stream4) Shifting to Suspend Mode"
 

Definition at line 337 of file generators.h.

Referenced by ReassembleStream4().

#define STREAM4_TCP_NO_ACK   23
 

Definition at line 100 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_TCP_NO_ACK_STR   "(spp_stream4) Packet in Established TCP stream missing ACK"
 

Definition at line 340 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_TTL_EVASION   15
 

Definition at line 92 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_TTL_EVASION_STR   "(spp_stream4) TTL LIMIT Exceeded"
 

Definition at line 328 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_WINDOW_VIOLATION   4
 

Definition at line 81 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_WINDOW_VIOLATION_STR   "(spp_stream4) WINDOW VIOLATION detection"
 

Definition at line 330 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_ZERO_TIMESTAMP   21
 

Definition at line 98 of file generators.h.

Referenced by StoreStreamPkt().

#define STREAM4_ZERO_TIMESTAMP_STR   "(spp_stream4) TCP Option Timestamp value of 0"
 

Definition at line 338 of file generators.h.

Referenced by StoreStreamPkt().

#define TAG_LOG_PKT   1
 

Definition at line 26 of file generators.h.

Referenced by CheckTagList(), OldUnifiedLogPacketAlert(), and RealUnifiedLogStreamAlert().

#define UNIDECODE_CGINULL_ATTACK   1
 

Definition at line 72 of file generators.h.

#define UNIDECODE_DIRECTORY_TRAVERSAL   2
 

Definition at line 73 of file generators.h.

#define UNIDECODE_INVALID_MAPPING   4
 

Definition at line 75 of file generators.h.

#define UNIDECODE_UNKNOWN_MAPPING   3
 

Definition at line 74 of file generators.h.


Generated on Sun May 14 14:51:23 2006 by  doxygen 1.4.2