mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
1104 lines
38 KiB
TeX
1104 lines
38 KiB
TeX
\batchmode
|
|
|
|
|
|
\documentclass[twoside]{report}
|
|
\RequirePackage{ifthen}
|
|
|
|
|
|
|
|
|
|
\frenchspacing
|
|
|
|
|
|
\sloppy
|
|
|
|
|
|
\usepackage{makeidx}
|
|
\usepackage{times}
|
|
\usepackage{psfig}
|
|
\usepackage{html}
|
|
|
|
|
|
\textwidth=6.5in
|
|
\oddsidemargin=-0.15in
|
|
\evensidemargin=-0.15in
|
|
|
|
|
|
\title{
|
|
The {\em Bro} 0.8 User Manual
|
|
}
|
|
|
|
%
|
|
\providecommand{\note}[1]{\emph{Note: #1}}%
|
|
\providecommand{\privatenote}[1]{}%
|
|
\providecommand{\updateme}[1]{#1}%
|
|
\providecommand{\unlikeC}[1]{\emph{Unlike with C,} #1}%
|
|
\providecommand{\deficiency}[1]{\emph{Deficiency: #1}}%
|
|
\providecommand{\fixme}[1]{\emph{Fix me: #1}}
|
|
|
|
%
|
|
\providecommand{\xref}[1]{\hyperref{\S~\ref{#1}}{}{}{#1}}%
|
|
\providecommand{\pxref}[1]{(\hyperref{\S~\ref{#1}}{}{}{#1})}%
|
|
\providecommand{\cxref}[1]{\hyperref{Chapter~\ref{#1}}{}{}{#1}}%
|
|
\providecommand{\link}[2]{\hyperref{#1}{}{}{#2}}%
|
|
\providecommand{\lab}[2]{\label{#1}{#2}}%
|
|
\providecommand{\labsectchapter}[2]{\chapter{#2 #1}}%
|
|
\providecommand{\labsectsection}[2]{\section{#2 #1}}%
|
|
\providecommand{\labsectsubsection}[2]{\subsection{#2 #1}}%
|
|
\providecommand{\labsectsubsubsection}[2]{\subsubsection{#2 #1}}%
|
|
\providecommand{\itemwithextra}[3]{\item[{\tt #1#3}]}%
|
|
\providecommand{\optsyntax}[1]{{\emph{[} \texttt{#1} \emph{]}}}%
|
|
\providecommand{\nl}{}
|
|
|
|
%
|
|
\providecommand{\itemwithtype}[2]{\item[{\tt #1 : #2}]}
|
|
|
|
%
|
|
\providecommand{\f}[1]{Figure~\ref{#1}}%
|
|
\providecommand{\tbl}[1]{Table~\ref{#1}}%
|
|
\providecommand{\percent}{{{\tt \%}}}%
|
|
\providecommand{\hash}{{{\tt \#}}}%
|
|
\providecommand{\caret}{{{\tt \^}}}%
|
|
\providecommand{\load}{{{\tt @load}{ }}}%
|
|
\providecommand{\loadx}{{{\tt @load}}}%
|
|
\providecommand{\prefix}{{{\tt @prefix}{ }}}%
|
|
\providecommand{\prefixx}{{{\tt @prefix}}}%
|
|
\providecommand{\void}{void}
|
|
|
|
%
|
|
\providecommand{\kludge}{{\tt \mbox{\hspace{0.01in}}~}}
|
|
|
|
%
|
|
\providecommand{\indplain}[2]{\index{#1 #2}\index{#2s!#1}{#1}}%
|
|
\providecommand{\indtt}[2]{\index{#1 #2@{\protect\tt #1} #2}\index{#2s}\index{#2s!#1@{\tt #1}}{{\tt #1}}}%
|
|
\providecommand{\indttbang}[2]{\index{#1@{\tt #1}}\index{#1!#2@#2}{{\tt #1}}}%
|
|
\providecommand{\indttparen}[2]{\index{#1 #2@{\protect\tt (#1)} #2}\index{#2s}\index{#2s!#1@{\tt (#1)}}{{\tt (#1)}}}%
|
|
\providecommand{\indttnotext}[2]{\index{#1 #2@{\protect\tt #1} #2}\index{#2s}\index{#2s!#1@{\tt #1}}}%
|
|
\providecommand{\indttnotexttwo}[3]{\index{#1 #2 #3@{\protect\tt #1 #2} #3}\index{#2 #3@{\tt #2} #3}\index{#2 #3!#1@{\tt #1}}}%
|
|
\providecommand{\indttzero}[1]{\index{#1@{\protect\tt #1}}{{\tt #1}}}%
|
|
\providecommand{\indtttwo}[3]{\index{#2@{\protect\tt #1} #3}\index{#3s}\index{#3s!#2@{\tt #1}}}%
|
|
\providecommand{\itemindtt}[2]{\index{#1 #2@{\protect\tt #1} #2}\index{#2s}\index{#2s!#1@{\tt #1}}\item[{\tt #1}]}%
|
|
\providecommand{\indttbegin}[2]{\index{#1 #2@{\protect\tt #1} #2|(}\index{#2s}\index{#2s!#1@{\tt #1}|(}{\tt #1}}%
|
|
\providecommand{\indttend}[2]{\index{#1 #2@{\protect\tt #1} #2|)}\index{#2s}\index{#2s!#1@{\tt #1}|)}{\tt #1}}
|
|
|
|
%
|
|
\providecommand{\opind}[1]{\index{#1 operator@{\protect\tt #1} operator}\index{operators!{\protect\tt #1}}}%
|
|
\providecommand{\indopone}[2]{\index{#1 #2@{\protect\tt #1} #2}\index{operators!{\protect\tt #1}}}%
|
|
\providecommand{\indoponekey}[3]{\index{#3@{\protect\tt #1} #2}\index{operators!{\protect\tt #1}}}%
|
|
\providecommand{\indoptwo}[2]{\index{#1 #2@{\protect\tt #1\protect\ } #2}\index{operators!{\protect\tt #1}}}
|
|
|
|
%
|
|
\providecommand{\keyind}[1]{\index{#1 keyword@{\protect\tt #1} keyword}\index{keywords!{\protect\tt #1}}}
|
|
|
|
%
|
|
\providecommand{\indevent}[2]{\index{#1 event@{\protect\tt #1} event}\index{events!{\protect\tt #1}}\label{#2-event}{{\tt #1}}}%
|
|
\providecommand{\itemindevent}[2]{\index{#1 event@{\protect\tt #1} event}\index{events!{\protect\tt #1}}\label{#2-event}{\item[{\tt #1}]}}%
|
|
\providecommand{\indeventnolabel}[1]{\index{#1 event@{\protect\tt #1} event}\index{events!{\protect\tt #1}}}%
|
|
\providecommand{\indeventtype}[3]{\index{#1 event@{\protect\tt #1} event}\index{events!{\protect\tt #1}}\label{#2-event}{\item[{\tt \tt #1 (#3)}]}}%
|
|
\providecommand{\indeventtypenolabel}[2]{\index{#1 event@{\protect\tt #1} event}\index{events!{\protect\tt #1}}\item[{\tt \tt #1 (#2)}]}%
|
|
\providecommand{\xrefevent}[2]{\hyperref{\tt #1}{}{}{#2-event}}%
|
|
\providecommand{\xrefindevent}[2]{\index{#1 event@{\protect\tt #1} event}\index{events!{\protect\tt #1}}\hyperref{\tt #1}{}{}{#2-event}}
|
|
|
|
%
|
|
\providecommand{\indenvnotext}[1]{\index{#1 environment variable@{\protect\tt \$#1} environment variable}\index{environment variables!#1@{\tt \$#1}}}%
|
|
\providecommand{\indenv}[2]{\index{#1 environment variable@{\protect\tt \$#1} environment variable}\index{environment variables!#1@{\tt \$#1}}\label{#2-env}{{\tt \$#1}}}%
|
|
\providecommand{\itemindenv}[2]{\index{#1 environment variable@{\protect\tt \$#1} environment variable}\index{environment variables!#1@{\tt \$#1}}\label{#2-env}{\item[{\tt \$#1}]} }%
|
|
\providecommand{\xrefenv}[2]{\hyperref{\tt \$#1}{}{}{#2-env}}
|
|
|
|
%
|
|
\providecommand{\analyzer}[1]{{\tt #1}}%
|
|
\providecommand{\indanalyzer}[2]{\index{#1 analyzer@{\protect\tt #1} analyzer}\index{analyzers!{\protect \tt #1}}\label{#2-analyzer-module}{{\tt #1}}}%
|
|
\providecommand{\indanalyzernolabel}[1]{{\index{#1 analyzer@{\protect\tt #1} analyzer}\index{analyzers!{\protect \tt #1}}{\tt #1}}}%
|
|
\providecommand{\xrefanalyzer}[2]{\hyperref{\tt #1}{}{}{#2-analyzer-module}}
|
|
|
|
%
|
|
\providecommand{\module}[1]{{\tt #1}}%
|
|
\providecommand{\indmodule}[2]{\index{#1 module@{\protect\tt #1} module}\index{modules!{\protect \tt #1}}\label{#2-analyzer-module}{{\tt #1}}}%
|
|
\providecommand{\xrefmodule}[2]{\hyperref{\tt #1}{}{}{#2-analyzer-module}}
|
|
|
|
%
|
|
\providecommand{\indfunc}[2]{\index{#1 function@{\protect\tt #1} function}\index{functions!{\protect \tt #1}}\label{#2-func}{{\tt #1}}}%
|
|
\providecommand{\itemindfunc}[3]{\index{#1 function@{\protect\tt #1} function}\index{functions!{\protect \tt #1}}\label{#2-func}{\item[{\tt \tt #1\tt #3 }]}}%
|
|
\providecommand{\indfuncnolabel}[2]{\index{#1 function@{\protect\tt #1} function}\index{functions!{\protect \tt #1}}{\tt #1}}%
|
|
\providecommand{\xreffunc}[2]{\hyperref{\tt #1}{}{}{#2-func}}%
|
|
\providecommand{\xrefindfunc}[2]{\index{#1 function@{\protect\tt #1} function}\index{functions!{\protect \tt #1}}\hyperref{\tt #1}{}{}{#2-func}}%
|
|
\providecommand{\xreffuncnott}[2]{\hyperref{\S~\ref{#2-func}}{}{}{#2-func}}
|
|
|
|
%
|
|
\providecommand{\xreflog}[1]{\hyperref{\tt #1}{}{}{#1-log}}
|
|
|
|
%
|
|
\providecommand{\itemindstmtemph}[1]{\index{#1 statement@{\protect\emph{#1}} statement}\index{statements!{\protect\emph{#1}}}\label{#1-stmt}{\item[{\emph{#1}}]}}%
|
|
\providecommand{\itemindstmttt}[1]{\index{#1 statement@{\protect\tt #1} statement}\index{statements!{\protect\tt #1}}\label{#1-stmt}{\item[{\tt #1}]}}%
|
|
\providecommand{\itemindstmttttwo}[2]{\index{#1 statement@{\protect\tt #1} statement}\index{#2 statement@{\protect\tt #2} statement}\index{statements!{\protect\tt #1}}\index{statements!{\protect\tt #2}}\label{#1-stmt}\label{#2-stmt}{\item[{\tt #1}, {\tt #2}]}}%
|
|
\providecommand{\xrefstmt}[2]{\hyperref{\tt #1}{}{}{#2-stmt}}
|
|
|
|
%
|
|
\providecommand{\itemindexpremph}[1]{\index{#1 expression@{\protect\emph{#1}} expression}\index{expressions!{\protect\emph{#1}}}\label{#1-expr}{\item[{\emph{#1}}]}}%
|
|
\providecommand{\itemindexprtt}[1]{\index{#1 expression@{\protect\tt #1} expression}\index{expressions!{\protect\tt #1}}\label{#1-expr}{\item[{\tt #1}]}}%
|
|
\providecommand{\itemindexprtttwo}[2]{\index{#1 expressions@{\protect\tt #1} expressions}\index{#2 expressions@{\protect\tt #2} expressions}\index{expressions!{\protect\tt #1}}\index{expressions!{\protect\tt #2}}\label{#1-expr}\label{#2-expr}{\item[{\tt #1}, {\tt #2}]}}%
|
|
\providecommand{\itemindexpremphtwo}[2]{\index{#1 expressions@{\protect\em #1} expressions}\index{#2 expressions@{\protect\em #2} expressions}\index{expressions!{\protect\em #1}}\index{expressions!{\protect\em #2}}\label{#1-expr}\label{#2-expr}{\item[{\em #1}, {\em #2}]}}%
|
|
\providecommand{\itemindexprtttwonott}[2]{\index{#1 expressions@{#1} expressions}\index{#2 expressions@{#2} expressions}\index{expressions!{#1}}\index{expressions!{#2}}\label{#1-expr}\label{#2-expr}{\item[{#1}, {#2}]}}%
|
|
\providecommand{\xrefexpr}[2]{\hyperref{\tt #1}{}{}{#2-expr}}
|
|
|
|
%
|
|
\providecommand{\indfield}[4]{\index{#1@{\tt #1}}\index{#1!#3@{\tt #3} field}\index{#3 record@{\tt #3} record}\label{#4-#2-field}{\item[{\tt #1}]}}%
|
|
\providecommand{\xreffield}[3]{\hyperref{\tt #1}{}{}{#3-#2-field}}%
|
|
\providecommand{\xrefscript}[2]{\hyperref{\tt #1}{}{}{#2-script}}
|
|
|
|
%
|
|
\providecommand{\indvar}[1]{\index{#1 variable@{\protect\tt #1} variable}\index{variables!{\protect \tt #1}}{\tt #1}}%
|
|
\providecommand{\indvartype}[3]{\index{#1 variable@{\protect\tt #1} variable}\index{variables!{\protect \tt #1}}\label{#2-var}{\item[{\tt \tt #1 : #3}]}}%
|
|
\providecommand{\indvarbegin}[1]{\index{#1 variable@{\tt #1} variable|(}\index{variables!{\protect \tt #1}|(}}%
|
|
\providecommand{\indvarend}[1]{\index{#1 variable@{\tt #1} variable|)}\index{variables!{\protect \tt #1}|)}}%
|
|
\providecommand{\xrefvar}[2]{\hyperref{\tt #1}{}{}{#2-var}}%
|
|
\providecommand{\xrefvarnott}[2]{\hyperref{\S~\ref{#2-var}}{}{}{#2-var}}%
|
|
\providecommand{\pxrefvarnott}[2]{(\hyperref{\S~\ref{#2-var}}{}{}{#2-var})}
|
|
|
|
%
|
|
\providecommand{\xreftype}[2]{\hyperref{\tt #1}{}{}{#2-type}}
|
|
|
|
%
|
|
\providecommand{\indattr}[2]{\index{#1 attribute@{\protect\tt \} attribute}\index{attributes!#1@{\tt \}}\label{#2-attr}{{\tt \}}}%
|
|
\providecommand{\indattrnotext}[1]{\index{#1 attribute@{\protect\tt \} attribute}\index{attributes!#1@{\tt \}}}%
|
|
\providecommand{\itemindattr}[2]{\index{#1 attribute@{\protect\tt \} attribute}\index{attributes!#1@{\tt \}}\label{#2-attr}{\item[{\tt \}]} }%
|
|
\providecommand{\xrefattr}[2]{\hyperref{\tt \}{}{}{#2-attr}}
|
|
|
|
%
|
|
\providecommand{\indintvar}[1]{\index{#1 internal variable@{\protect\tt #1} internal variable}\index{internal variables!{\protect \tt #1}}{\tt #1}}
|
|
|
|
%
|
|
\providecommand{\indformat}[1]{\index{#1 format@{\protect\tt #1} format}\index{format!#1@{\tt #1}}\item[#1]}%
|
|
\providecommand{\indformatnoitem}[1]{\index{#1 format@{\protect\tt #1} format}\index{format!#1@{\tt #1}}}
|
|
|
|
%
|
|
\providecommand{\indweird}[2]{\index{#1 (``weird'' event)@{\protect\tt #1} (``weird'' event)}\index{weird event@``weird'' event}\index{weird event!#1@{\protect \tt #1}}\label{#2-weird}{\item[{\tt #1}]}}
|
|
|
|
%
|
|
\providecommand{\indextext}[2]{\index{#1 (#2)@{\protect\tt "#1"} (#2)}\index{#2s}\index{#2s!#1@{\tt "#1"}}{\tt "#1"}}%
|
|
\providecommand{\indexmsg}[1]{\index{#1@{\protect\tt "#1"}}\index{message!{\protect \tt "#1"}}}
|
|
|
|
%
|
|
\providecommand{\indfatal}[1]{\index{#1!fatal run-time error}\index{fatal run-time error!#1}\index{run-time error!#1}}%
|
|
\providecommand{\indruntime}[1]{\index{#1!run-time error}\index{run-time error!#1}}
|
|
|
|
%
|
|
\providecommand{\indglobalnotext}[1]{{\index{#1 global variable@{\protect\tt #1} global variable}}{\index{global variables!{\protect\tt #1}}}}%
|
|
\providecommand{\indglobal}[1]{{\index{#1 global variable@{\protect\tt #1} global variable}}{\index{global variables!{\protect\tt #1}}}{\tt #1}}
|
|
|
|
%
|
|
\providecommand{\indpredefvar}[3]{\index{#1 variable@{\protect\tt #1} variable}\index{predefined variables!{\protect \tt #1}}\index{variables!{\protect \tt #1}}\label{#2-global}{\item[{\tt \tt #1 : #3}]}}
|
|
|
|
%
|
|
\providecommand{\xrefglobal}[2]{\hyperref{\tt #1}{}{}{#2-global}}%
|
|
\providecommand{\xrefglobalind}[2]{\hyperref{\tt #1}{}{}{#2-global}{\index{#1 global variable@{\protect\tt #1} global variable}}{\index{global variables!{\protect\tt #1}}}}
|
|
|
|
%
|
|
\providecommand{\indlibrary}[2]{{\index{#1 library@{\protect\em #1} library}}{\index{libraries!{\protect\em #1}}}{\index{libraries!{\protect\em #1}}}\label{#2-library}{{\em #1}}}%
|
|
\providecommand{\xreflibrary}[2]{\hyperref{\emph{#1}}{}{}{#2-library}}
|
|
|
|
%
|
|
\providecommand{\indutility}[2]{{\index{#1 utility program@{\protect\em #1} utility program}}{\index{programs!{\protect\em #1}}}{\index{utility programs!{\protect\em #1}}}\label{#2-utility}{{\em #1}}}%
|
|
\providecommand{\xrefutility}[2]{\hyperref{\emph{#1}}{}{}{#2-utility}}
|
|
|
|
%
|
|
\providecommand{\mkflagind}[1]{\index{#1 flag@{\protect\tt -#1} flag}\index{flags!{\protect \tt -#1}}\index{Bro!flags!{\protect \tt -#1}}}%
|
|
\providecommand{\indflag}[1]{\index{#1 flag@{\protect\tt -#1} flag}\index{flags!{\protect \tt -#1}}\index{Bro!flags!{\protect \tt -#1}}\label{flag-#1}{\item[{\tt -#1}]}}%
|
|
\providecommand{\indflagnoitem}[1]{\index{#1 flag@{\protect\tt -#1} flag}\index{flags!{\protect \tt -#1}}\index{Bro!flags!{\protect \tt -#1}}{\tt -#1}}%
|
|
\providecommand{\indflagtwo}[2]{\index{#1 flag@{\protect\tt -#1} flag}\index{flags!{\protect \tt -#1}}\index{Bro!flags!{\protect \tt -#1}}\label{flag-#1}{\item[{\tt \tt -#1 \emph{#2}}] \\}}%
|
|
\providecommand{\xrefflag}[1]{\hyperref{\tt #1}{}{}{flag#1}}
|
|
|
|
%
|
|
\providecommand{\indpredeffunc}[3]{\index{#1 function@{\tt #1} function}\index{predefined functions!{\protect \tt #1}}\index{functions!{\protect \tt #1}}\label{#2-func}{\item[{\tt \tt #1 #3}]}}%
|
|
\providecommand{\indpredeffuncnolab}[2]{\index{#1 predefined function@{\tt #1} predefined function}\index{predefined functions!{\protect \tt #1}}\index{functions!{\protect \tt #1}}\item[{\tt \tt #1 #2}]}
|
|
|
|
%
|
|
\providecommand{\indtype}[1]{\index{#1@{\protect\tt #1}|see{types, {\protect\tt #1}}}}
|
|
|
|
%
|
|
\providecommand{\indconfig}[2]{\index{#1 configuration option@{\tt {--}#1} configuration option}\index{configuration options!{\tt {--}#1}}\label{#2-config}{{\tt {--}#1}}}%
|
|
\providecommand{\xrefconfig}[2]{\hyperref{\tt {--}#1}{}{}{#2-config}}
|
|
|
|
%
|
|
\providecommand{\addindextocentry}{\addcontentsline{toc}{chapter}{\protect\numberline{Index}{}}}
|
|
|
|
%
|
|
\providecommand{\indsigattr}[1]{\item[\tt #1]}
|
|
|
|
|
|
\makeindex
|
|
|
|
|
|
|
|
|
|
\usepackage[dvips]{color}
|
|
|
|
|
|
\pagecolor[gray]{.7}
|
|
|
|
\usepackage[latin1]{inputenc}
|
|
|
|
|
|
|
|
\makeatletter
|
|
|
|
\makeatletter
|
|
\count@=\the\catcode`\_ \catcode`\_=8
|
|
\newenvironment{tex2html_wrap}{}{}%
|
|
\catcode`\<=12\catcode`\_=\count@
|
|
\newcommand{\providedcommand}[1]{\expandafter\providecommand\csname #1\endcsname}%
|
|
\newcommand{\renewedcommand}[1]{\expandafter\providecommand\csname #1\endcsname{}%
|
|
\expandafter\renewcommand\csname #1\endcsname}%
|
|
\newcommand{\newedenvironment}[1]{\newenvironment{#1}{}{}\renewenvironment{#1}}%
|
|
\let\newedcommand\renewedcommand
|
|
\let\renewedenvironment\newedenvironment
|
|
\makeatother
|
|
\let\mathon=$
|
|
\let\mathoff=$
|
|
\ifx\AtBeginDocument\undefined \newcommand{\AtBeginDocument}[1]{}\fi
|
|
\newbox\sizebox
|
|
\setlength{\hoffset}{0pt}\setlength{\voffset}{0pt}
|
|
\addtolength{\textheight}{\footskip}\setlength{\footskip}{0pt}
|
|
\addtolength{\textheight}{\topmargin}\setlength{\topmargin}{0pt}
|
|
\addtolength{\textheight}{\headheight}\setlength{\headheight}{0pt}
|
|
\addtolength{\textheight}{\headsep}\setlength{\headsep}{0pt}
|
|
\setlength{\textwidth}{349pt}
|
|
\newwrite\lthtmlwrite
|
|
\makeatletter
|
|
\let\realnormalsize=\normalsize
|
|
\global\topskip=2sp
|
|
\def\preveqno{}\let\real@float=\@float \let\realend@float=\end@float
|
|
\def\@float{\let\@savefreelist\@freelist\real@float}
|
|
\def\liih@math{\ifmmode$\else\bad@math\fi}
|
|
\def\end@float{\realend@float\global\let\@freelist\@savefreelist}
|
|
\let\real@dbflt=\@dbflt \let\end@dblfloat=\end@float
|
|
\let\@largefloatcheck=\relax
|
|
\let\if@boxedmulticols=\iftrue
|
|
\def\@dbflt{\let\@savefreelist\@freelist\real@dbflt}
|
|
\def\adjustnormalsize{\def\normalsize{\mathsurround=0pt \realnormalsize
|
|
\parindent=0pt\abovedisplayskip=0pt\belowdisplayskip=0pt}%
|
|
\def\phantompar{\csname par\endcsname}\normalsize}%
|
|
\def\lthtmltypeout#1{{\let\protect\string \immediate\write\lthtmlwrite{#1}}}%
|
|
\newcommand\lthtmlhboxmathA{\adjustnormalsize\setbox\sizebox=\hbox\bgroup\kern.05em }%
|
|
\newcommand\lthtmlhboxmathB{\adjustnormalsize\setbox\sizebox=\hbox to\hsize\bgroup\hfill }%
|
|
\newcommand\lthtmlvboxmathA{\adjustnormalsize\setbox\sizebox=\vbox\bgroup %
|
|
\let\ifinner=\iffalse \let\)\liih@math }%
|
|
\newcommand\lthtmlboxmathZ{\@next\next\@currlist{}{\def\next{\voidb@x}}%
|
|
\expandafter\box\next\egroup}%
|
|
\newcommand\lthtmlmathtype[1]{\gdef\lthtmlmathenv{#1}}%
|
|
\newcommand\lthtmllogmath{\lthtmltypeout{l2hSize %
|
|
:\lthtmlmathenv:\the\ht\sizebox::\the\dp\sizebox::\the\wd\sizebox.\preveqno}}%
|
|
\newcommand\lthtmlfigureA[1]{\let\@savefreelist\@freelist
|
|
\lthtmlmathtype{#1}\lthtmlvboxmathA}%
|
|
\newcommand\lthtmlpictureA{\bgroup\catcode`\_=8 \lthtmlpictureB}%
|
|
\newcommand\lthtmlpictureB[1]{\lthtmlmathtype{#1}\egroup
|
|
\let\@savefreelist\@freelist \lthtmlhboxmathB}%
|
|
\newcommand\lthtmlpictureZ[1]{\hfill\lthtmlfigureZ}%
|
|
\newcommand\lthtmlfigureZ{\lthtmlboxmathZ\lthtmllogmath\copy\sizebox
|
|
\global\let\@freelist\@savefreelist}%
|
|
\newcommand\lthtmldisplayA{\bgroup\catcode`\_=8 \lthtmldisplayAi}%
|
|
\newcommand\lthtmldisplayAi[1]{\lthtmlmathtype{#1}\egroup\lthtmlvboxmathA}%
|
|
\newcommand\lthtmldisplayB[1]{\edef\preveqno{(\theequation)}%
|
|
\lthtmldisplayA{#1}\let\@eqnnum\relax}%
|
|
\newcommand\lthtmldisplayZ{\lthtmlboxmathZ\lthtmllogmath\lthtmlsetmath}%
|
|
\newcommand\lthtmlinlinemathA{\bgroup\catcode`\_=8 \lthtmlinlinemathB}
|
|
\newcommand\lthtmlinlinemathB[1]{\lthtmlmathtype{#1}\egroup\lthtmlhboxmathA
|
|
\vrule height1.5ex width0pt }%
|
|
\newcommand\lthtmlinlineA{\bgroup\catcode`\_=8 \lthtmlinlineB}%
|
|
\newcommand\lthtmlinlineB[1]{\lthtmlmathtype{#1}\egroup\lthtmlhboxmathA}%
|
|
\newcommand\lthtmlinlineZ{\egroup\expandafter\ifdim\dp\sizebox>0pt %
|
|
\expandafter\centerinlinemath\fi\lthtmllogmath\lthtmlsetinline}
|
|
\newcommand\lthtmlinlinemathZ{\egroup\expandafter\ifdim\dp\sizebox>0pt %
|
|
\expandafter\centerinlinemath\fi\lthtmllogmath\lthtmlsetmath}
|
|
\newcommand\lthtmlindisplaymathZ{\egroup %
|
|
\centerinlinemath\lthtmllogmath\lthtmlsetmath}
|
|
\def\lthtmlsetinline{\hbox{\vrule width.1em \vtop{\vbox{%
|
|
\kern.1em\copy\sizebox}\ifdim\dp\sizebox>0pt\kern.1em\else\kern.3pt\fi
|
|
\ifdim\hsize>\wd\sizebox \hrule depth1pt\fi}}}
|
|
\def\lthtmlsetmath{\hbox{\vrule width.1em\kern-.05em\vtop{\vbox{%
|
|
\kern.1em\kern0.8 pt\hbox{\hglue.17em\copy\sizebox\hglue0.8 pt}}\kern.3pt%
|
|
\ifdim\dp\sizebox>0pt\kern.1em\fi \kern0.8 pt%
|
|
\ifdim\hsize>\wd\sizebox \hrule depth1pt\fi}}}
|
|
\def\centerinlinemath{%
|
|
\dimen1=\ifdim\ht\sizebox<\dp\sizebox \dp\sizebox\else\ht\sizebox\fi
|
|
\advance\dimen1by.5pt \vrule width0pt height\dimen1 depth\dimen1
|
|
\dp\sizebox=\dimen1\ht\sizebox=\dimen1\relax}
|
|
|
|
\def\lthtmlcheckvsize{\ifdim\ht\sizebox<\vsize
|
|
\ifdim\wd\sizebox<\hsize\expandafter\hfill\fi \expandafter\vfill
|
|
\else\expandafter\vss\fi}%
|
|
\providecommand{\selectlanguage}[1]{}%
|
|
\makeatletter \tracingstats = 1
|
|
|
|
|
|
\begin{document}
|
|
\pagestyle{empty}\thispagestyle{empty}\lthtmltypeout{}%
|
|
\lthtmltypeout{latex2htmlLength hsize=\the\hsize}\lthtmltypeout{}%
|
|
\lthtmltypeout{latex2htmlLength vsize=\the\vsize}\lthtmltypeout{}%
|
|
\lthtmltypeout{latex2htmlLength hoffset=\the\hoffset}\lthtmltypeout{}%
|
|
\lthtmltypeout{latex2htmlLength voffset=\the\voffset}\lthtmltypeout{}%
|
|
\lthtmltypeout{latex2htmlLength topmargin=\the\topmargin}\lthtmltypeout{}%
|
|
\lthtmltypeout{latex2htmlLength topskip=\the\topskip}\lthtmltypeout{}%
|
|
\lthtmltypeout{latex2htmlLength headheight=\the\headheight}\lthtmltypeout{}%
|
|
\lthtmltypeout{latex2htmlLength headsep=\the\headsep}\lthtmltypeout{}%
|
|
\lthtmltypeout{latex2htmlLength parskip=\the\parskip}\lthtmltypeout{}%
|
|
\lthtmltypeout{latex2htmlLength oddsidemargin=\the\oddsidemargin}\lthtmltypeout{}%
|
|
\makeatletter
|
|
\if@twoside\lthtmltypeout{latex2htmlLength evensidemargin=\the\evensidemargin}%
|
|
\else\lthtmltypeout{latex2htmlLength evensidemargin=\the\oddsidemargin}\fi%
|
|
\lthtmltypeout{}%
|
|
\makeatother
|
|
\setcounter{page}{1}
|
|
\onecolumn
|
|
|
|
% !!! IMAGES START HERE !!!
|
|
|
|
\stepcounter{chapter}
|
|
\stepcounter{chapter}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{chapter}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsubsection}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline5436}%
|
|
$~\tilde{~}~~~$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline5438}%
|
|
$\tilde{~}~~$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline5440}%
|
|
$A\_1 {\tt .} A\_2 {\tt .} A\_3 {\tt .} A\_4$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline5442}%
|
|
$A\_i$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline5444}%
|
|
$2^{24}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline5446}%
|
|
$2^{16}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline5448}%
|
|
$2^8$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline5450}%
|
|
$N\_1 {\tt .} N\_2 {\tt .}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline5452}%
|
|
$N\_1 {\tt .} N\_2 {\tt .} N\_3 $%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline5454}%
|
|
$N\_i$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline5456}%
|
|
$^+$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline5458}%
|
|
$^*$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{chapter}
|
|
\stepcounter{section}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline8536}%
|
|
$_{2}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline8540}%
|
|
$_{1}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{section}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline8614}%
|
|
$_{3}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{chapter}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
|
|
%
|
|
\providecommand{\constmsg}{\\NOTE: This variable is {\tt const},
|
|
so may only be changed via {\tt redef}.}%
|
|
|
|
\stepcounter{chapter}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline16373}%
|
|
$\le 26$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline16375}%
|
|
$m$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline16379}%
|
|
$n$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline16393}%
|
|
$h$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{chapter}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{figure22361}%
|
|
\begin{figure}\begin{verbatim}
|
|
|
|
event bro_init()
|
|
{
|
|
if ( restrict_filter == "" && capture_filter == "" )
|
|
print "tcp or not tcp"; # Capture everything.
|
|
|
|
else if ( restrict_filter == "" )
|
|
print capture_filter;
|
|
|
|
else if ( capture_filter == "" )
|
|
print restrict_filter;
|
|
|
|
else
|
|
print fmt("(%s) and (%s)", capture_filter, restrict_filter);
|
|
|
|
exit();
|
|
}\end{verbatim}
|
|
|
|
\end{figure}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{section}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{figure22485}%
|
|
\begin{figure}\begin{verbatim}
|
|
|
|
type net_stats: record {
|
|
# All counts are cumulative.
|
|
pkts_recvd: count; # Number of packets received so far.
|
|
pkts_dropped: count; # Number of packets *reported* dropped.
|
|
interface_drops: count; # Number of drops reported by interface(s).
|
|
};\end{verbatim}
|
|
|
|
\end{figure}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{figure22528}%
|
|
\begin{figure}\begin{verbatim}
|
|
|
|
type conn_id: record {
|
|
orig_h: addr; # Address of originating host.
|
|
orig_p: port; # Port used by originator.
|
|
resp_h: addr; # Address of responding host.
|
|
resp_p: port; # Port used by responder.
|
|
};
|
|
|
|
type endpoint: record {
|
|
size: count; # Bytes sent by this endpoint so far.
|
|
state: count; # The endpoint's current state.
|
|
};
|
|
|
|
type connection: record {
|
|
id: conn_id; # Originator/responder addresses/ports.
|
|
orig: endpoint; # Endpoint info for originator.
|
|
resp: endpoint; # Endpoint info for responder.
|
|
start_time: time; # When the connection began.
|
|
duration: interval; # How long it was active (or has been so far).
|
|
service: string; # The service we associate with it (e.g., "http").
|
|
addl: string; # Additional information associated with it.
|
|
hot: count; # How many times we've marked it as sensitive.
|
|
};\end{verbatim}
|
|
|
|
\end{figure}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31877}%
|
|
$A$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31879}%
|
|
$B$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31899}%
|
|
$B_{o}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31901}%
|
|
$B_{r}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31903}%
|
|
$A_{l}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31905}%
|
|
$A_{r}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31927}%
|
|
$A_{o}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31937}%
|
|
$S_{o}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31941}%
|
|
$S_{r}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31943}%
|
|
$D$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31957}%
|
|
$P_{o}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31961}%
|
|
$P_{r}$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31971}%
|
|
$p$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{figure23775}%
|
|
\begin{figure}\begin{verbatim}
|
|
|
|
global msg_count: table[string] of count &default = 0;
|
|
|
|
event log_summary(msg: string)
|
|
{
|
|
log fmt("(%s) %d times", msg, msg_count[msg]);
|
|
}
|
|
|
|
function log_hook(msg: string): bool
|
|
{
|
|
if ( ++msg_count[msg] == 1 )
|
|
# First time we've seen this message - log it.
|
|
return T;
|
|
|
|
if ( msg_count[msg] == 5 )
|
|
# We've seen it five times, enough to be worth
|
|
# summarizing. Do so five minutes from now,
|
|
# for whatever total we've seen by then.
|
|
schedule +5 min { log_summary(msg) };
|
|
|
|
return F;
|
|
}\end{verbatim}
|
|
|
|
\end{figure}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{figure23860}%
|
|
\begin{figure}\begin{verbatim}
|
|
|
|
type dns_mapping: record {
|
|
creation_time: time; # When the mapping was created.
|
|
|
|
req_host: string; # The hostname in the request, if any.
|
|
req_addr: addr; # The address in the request, if any.
|
|
|
|
valid: bool; # Whether we received an answer.
|
|
hostname: string; # The hostname in the answer, or "<none>".
|
|
addrs: set[addr]; # The addresses in the answer, if any.
|
|
};\end{verbatim}
|
|
|
|
\end{figure}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{figure24088}%
|
|
\begin{figure}\begin{verbatim}
|
|
|
|
type ftp_session_info: record {
|
|
id: count; # unique number associated w/ session
|
|
user: string; # username, if determined
|
|
request: string; # pending request or requests
|
|
num_requests: count; # count of pending requests
|
|
request_t: time; # time of request
|
|
log_if_not_denied: bool; # unless code 530 on reply, log it
|
|
log_if_not_unavail: bool; # unless code 550 on reply, log it
|
|
log_it: bool; # if true, log the request(s)
|
|
};\end{verbatim}
|
|
|
|
\end{figure}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{figure24192}%
|
|
\begin{figure}\begin{verbatim}
|
|
|
|
972499885.784104 #26 131.243.70.68/1899 > 64.55.26.206/ftp start
|
|
972499886.685046 #26 response (220 tuvok.ooc.com FTP server
|
|
(Version wu-2.6.0(1) Fri Jun 23 09:17:44 EDT 2000) ready.)
|
|
972499886.686025 #26 USER anonymous/IEUser@ (logged in)
|
|
972499887.850621 #26 TYPE I (ok)
|
|
972499888.421741 #26 PASV (227 64.55.26.206/2427)
|
|
972499889.493020 #26 SIZE /pub/OB/4.0/JOB-4.0.3.zip (213 1675597)
|
|
972499890.135706 #26 *RETR /pub/OB/4.0/JOB-4.0.3.zip, ABOR (complete)
|
|
972500055.491045 #26 response (225 ABOR command successful.)\end{verbatim}
|
|
|
|
\end{figure}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{figure24357}%
|
|
\begin{figure}\begin{verbatim}
|
|
|
|
972482763.371224 %1596 start 200.241.229.80 > 131.243.2.12
|
|
%1596 GET /ITG.hm.pg.docs/dissect/portuguese/dissect.html
|
|
%1596 GET /vfrog/bottom.icon.gif
|
|
%1596 GET /vfrog/top.icon.gif
|
|
%1596 GET /vfrog/movies/off.gif
|
|
%1596 GET /vfrog/new.frog.small.gif
|
|
\end{verbatim}
|
|
|
|
\end{figure}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31983}%
|
|
$\le 2$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31987}%
|
|
$\ge 256$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31989}%
|
|
$\ge 1024$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31991}%
|
|
$\ge$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{figure25695}%
|
|
\begin{figure}\begin{verbatim}
|
|
|
|
type x509: record {
|
|
issuer: string; # issuer name of the certificate
|
|
subject: string; # subject name of the certificate
|
|
};\end{verbatim}
|
|
|
|
\end{figure}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{figure25707}%
|
|
\begin{figure}\begin{verbatim}
|
|
|
|
type ssl_connection_info: record {
|
|
id: count; # the log identifier number
|
|
connection_id: conn_id; # IP connection information
|
|
version: count; # version associated with connection
|
|
client_cert: x509;
|
|
server_cert: x509;
|
|
id_index: string; # index for associated sessionID
|
|
handshake_cipher: count; # cipher suite client and server agreed upon
|
|
};\end{verbatim}
|
|
|
|
\end{figure}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{figure25794}%
|
|
\begin{figure}\begin{verbatim}
|
|
|
|
1046778101.534846 #1 192.168.0.98/32988 > 213.61.126.124/https start
|
|
1046778101.534846 #1 connection attempt version: 3.1
|
|
1046778101.534846 #1 cipher suites: SSLv3x_RSA_WITH_RC4_128_MD5 (0x4), SSLv3x_RSA_FIPS_WITH_3DES_EDE_CBC_SHA (0xFEFF), SSLv3x_RSA_WITH_3DES_EDE_CBC_SHA (0xA), SSLv3x_RSA_FIPS_WITH_DES_CBC_SHA (0xFEFE), SSLv3x_RSA_WITH_DES_CBC_SHA(0x9), SSLv3x_RSA_EXPORT1024_WITH_RC4_56_SHA (0x64), SSLv3x_RSA_EXPORT1024_WITH_DES_CBC_SHA (0x62), SSLv3x_RSA_EXPORT_WITH_RC4_40_MD5 (0x3), SSLv3x_RSA_EXPORT_WITH_RC2_CBC_40_MD5 (0x6),
|
|
1046778101.753356 #1 server reply, version: 3.1
|
|
1046778101.753356 #1 cipher suite: SSLv3x_RSA_WITH_RC4_128_MD5 (0x4),
|
|
1046778101.762601 #1 X.509 server issuer: /C=DE/ST=Hamburg/L=Hamburg/O=TC TrustCenter for Security in Data Networks GmbH/OU=TC TrustCenter Class 3 CA/Email=certificate@trustcenter.de,
|
|
1046778101.762601 #1 X.509 server subject: /C=DE/ST=Berlin/O=Lehmanns Fachbuchhandlung GmbH/OU=Zentrale EDV/CN=www.jfl.de/Email=admin@lehmanns.de
|
|
1046778101.894567 #1 handshake finished, version 3.1, cipher suite: SSLv3x_RSA_WITH_RC4_128_MD5 (0x4)
|
|
1046778104.877207 #1 finish
|
|
---
|
|
Used cipher-suites statistics:
|
|
SSLv3x_RSA_WITH_RC4_128_MD5 (0x4): 1\end{verbatim}
|
|
|
|
\end{figure}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline31993}%
|
|
$2 \cdot \mbox{MSL} = 4$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{chapter}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{subsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
\stepcounter{subsubsection}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{figure39539}%
|
|
\begin{figure} \begin{verbatim}
|
|
|
|
type signature_state: record {
|
|
id: string; # ID of the signature
|
|
conn: connection; # Current connection
|
|
is_orig: bool; # True if current endpoint is originator
|
|
payload_size: count; # Payload size of the first pkt of curr. endpoint
|
|
};\end{verbatim}
|
|
|
|
|
|
\end{figure}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{subsection}
|
|
\stepcounter{section}
|
|
\stepcounter{chapter}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline39988}%
|
|
$N$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
{\newpage\clearpage
|
|
\lthtmlinlinemathA{tex2html_wrap_inline39992}%
|
|
$\pm N$%
|
|
\lthtmlinlinemathZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
\stepcounter{chapter}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
\stepcounter{section}
|
|
{\newpage\clearpage
|
|
\lthtmlfigureA{center42103}%
|
|
\begin{center}\vbox{\input{index.tex}
|
|
}\end{center}%
|
|
\lthtmlfigureZ
|
|
\lthtmlcheckvsize\clearpage}
|
|
|
|
|
|
\end{document}
|