2010-08-16 22:09:34 +02:00
\hypertarget { struct_ _ AI_ _ snort_ _ alert} {
\section { \_ \- AI\_ \- snort\_ \- alert Struct Reference}
\label { struct_ _ AI_ _ snort_ _ alert} \index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} }
}
{ \ttfamily \# include $ < $ spp\_ \- ai.h$ > $ }
\subsection * { Data Fields}
\begin { DoxyCompactItemize}
\item
unsigned int \hyperlink { struct_ _ AI_ _ snort_ _ alert_ af8408be5da59cda853442dd13465c0f6} { gid}
\item
unsigned int \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a3349aa68d2234f8ffd897367c3a8a137} { sid}
\item
unsigned int \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a864d3baa48586d6a31639f4cd27d9d37} { rev}
\item
unsigned short \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a25661fa4e212c5e30af5e6a892985ec9} { priority}
\item
char $ \ast $ \hyperlink { struct_ _ AI_ _ snort_ _ alert_ ac0902d7c756ec675fb06347ce4706135} { desc}
\item
char $ \ast $ \hyperlink { struct_ _ AI_ _ snort_ _ alert_ aa89585e14acb2c4e684a1552d322632f} { classification}
\item
time\_ \- t \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a10a67f60ca3da339a2104849a0b2ac19} { timestamp}
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ aba7bc1797add20fe3efdf37ced1182c5} { uint8\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a3f3c47f9baf3229d067504a85873b416} { ip\_ \- tos}
2010-08-16 22:09:34 +02:00
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ a273cf69d639a59973b6019625df33e30} { uint16\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ ad3ffe99036513d5f33b94d22fb84f8f1} { ip\_ \- len}
2010-08-16 22:09:34 +02:00
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ a273cf69d639a59973b6019625df33e30} { uint16\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a2fc673dec85a7b49dd16ac7c0bb1bb78} { ip\_ \- id}
2010-08-16 22:09:34 +02:00
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ aba7bc1797add20fe3efdf37ced1182c5} { uint8\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a3c9bbe84ec696cd58668a45799a66600} { ip\_ \- ttl}
2010-08-16 22:09:34 +02:00
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ aba7bc1797add20fe3efdf37ced1182c5} { uint8\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a5ea7b250ac1c472f3ab57565b6df2536} { ip\_ \- proto}
2010-08-16 22:09:34 +02:00
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ a435d1572bf3f880d55459d9805097f62} { uint32\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a194117c57a52933d16a97838562bb611} { ip\_ \- src\_ \- addr}
2010-08-16 22:09:34 +02:00
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ a435d1572bf3f880d55459d9805097f62} { uint32\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a754ca683593c838e4032fa8c13b1512b} { ip\_ \- dst\_ \- addr}
2010-08-16 22:09:34 +02:00
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ a273cf69d639a59973b6019625df33e30} { uint16\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a4d4cbdbd9675f4c43545547f55174cb7} { tcp\_ \- src\_ \- port}
2010-08-16 22:09:34 +02:00
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ a273cf69d639a59973b6019625df33e30} { uint16\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ aaca31cb67d48ffc3bfd1227686d5f5a4} { tcp\_ \- dst\_ \- port}
2010-08-16 22:09:34 +02:00
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ a435d1572bf3f880d55459d9805097f62} { uint32\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ ad6edf59fccea55bf5f940bf36117020b} { tcp\_ \- seq}
2010-08-16 22:09:34 +02:00
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ a435d1572bf3f880d55459d9805097f62} { uint32\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a8aac577224a4325ec50511c6d79b4b79} { tcp\_ \- ack}
2010-08-16 22:09:34 +02:00
\item
\hyperlink { spp_ _ ai_ 8h_ aba7bc1797add20fe3efdf37ced1182c5} { uint8\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ aa643f11db93b70242b57f0a04775e507} { tcp\_ \- flags}
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ a273cf69d639a59973b6019625df33e30} { uint16\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a1687fccc26bb211591db8b36ffec5348} { tcp\_ \- window}
2010-08-16 22:09:34 +02:00
\item
2010-09-04 21:33:53 +02:00
\hyperlink { spp_ _ ai_ 8h_ a273cf69d639a59973b6019625df33e30} { uint16\_ \- t} \hyperlink { struct_ _ AI_ _ snort_ _ alert_ ab7e0507050b8e475fea7a4b26c768857} { tcp\_ \- len}
2010-08-16 22:09:34 +02:00
\item
struct \hyperlink { structpkt_ _ info} { pkt\_ \- info} $ \ast $ \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a09dfe0a841fd3912ec78060d4547cb31} { stream}
\item
struct \hyperlink { struct_ _ AI_ _ snort_ _ alert} { \_ \- AI\_ \- snort\_ \- alert} $ \ast $ \hyperlink { struct_ _ AI_ _ snort_ _ alert_ aa8336d4b3359015ed8ea312ca1fd1173} { next}
\item
\hyperlink { struct_ _ hierarchy_ _ node} { hierarchy\_ \- node} $ \ast $ \hyperlink { struct_ _ AI_ _ snort_ _ alert_ ac53765584296ead1328eabfaba8a3aed} { h\_ \- node} \mbox { [} CLUSTER\_ \- TYPES\mbox { ]}
\item
unsigned int \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a285aff12d6bac03c316ccc5305d28e53} { grouped\_ \- alarms\_ \- count}
2010-09-11 12:45:30 +02:00
\item
\hyperlink { structAI_ _ hyperalert_ _ info} { AI\_ \- hyperalert\_ \- info} $ \ast $ \hyperlink { struct_ _ AI_ _ snort_ _ alert_ ac101de15b4f9451f235b82122f77b62a} { hyperalert}
2010-09-14 19:24:03 +02:00
\item
struct \hyperlink { struct_ _ AI_ _ snort_ _ alert} { \_ \- AI\_ \- snort\_ \- alert} $ \ast $ \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a55a5488c7ee7706ded4c16b1235fd9c7} { previous\_ \- correlated}
\item
struct \hyperlink { struct_ _ AI_ _ snort_ _ alert} { \_ \- AI\_ \- snort\_ \- alert} $ \ast $ $ \ast $ \hyperlink { struct_ _ AI_ _ snort_ _ alert_ aac5e4078600ed17532db1f3d78165390} { derived\_ \- alerts}
\item
unsigned int \hyperlink { struct_ _ AI_ _ snort_ _ alert_ a1f2d5e8cfd0e6321b977173d1e90cb68} { n\_ \- derived\_ \- alerts}
2010-08-16 22:09:34 +02:00
\end { DoxyCompactItemize}
2010-09-04 21:33:53 +02:00
\subsection { Detailed Description}
Data type for Snort alerts
2010-08-16 22:09:34 +02:00
\subsection { Field Documentation}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ aa89585e14acb2c4e684a1552d322632f} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !classification@{ classification} }
\index { classification@{ classification} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{classification}] { \setlength { \rightskip } { 0pt plus 5cm} char$ \ast $ { \bf \_ \- AI\_ \- snort\_ \- alert::classification} } }
\label { struct_ _ AI_ _ snort_ _ alert_ aa89585e14acb2c4e684a1552d322632f}
2010-09-14 19:24:03 +02:00
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ aac5e4078600ed17532db1f3d78165390} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !derived\_ \- alerts@{ derived\_ \- alerts} }
\index { derived\_ \- alerts@{ derived\_ \- alerts} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{derived\_\-alerts}] { \setlength { \rightskip } { 0pt plus 5cm} struct { \bf \_ \- AI\_ \- snort\_ \- alert} $ \ast $ $ \ast $ { \bf \_ \- AI\_ \- snort\_ \- alert::derived\_ \- alerts} } }
\label { struct_ _ AI_ _ snort_ _ alert_ aac5e4078600ed17532db1f3d78165390}
Array of directly correlated 'derived' alerts from the current one, if any \hypertarget { struct_ _ AI_ _ snort_ _ alert_ ac0902d7c756ec675fb06347ce4706135} {
2010-08-16 22:09:34 +02:00
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !desc@{ desc} }
\index { desc@{ desc} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{desc}] { \setlength { \rightskip } { 0pt plus 5cm} char$ \ast $ { \bf \_ \- AI\_ \- snort\_ \- alert::desc} } }
\label { struct_ _ AI_ _ snort_ _ alert_ ac0902d7c756ec675fb06347ce4706135}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ af8408be5da59cda853442dd13465c0f6} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !gid@{ gid} }
\index { gid@{ gid} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{gid}] { \setlength { \rightskip } { 0pt plus 5cm} unsigned int { \bf \_ \- AI\_ \- snort\_ \- alert::gid} } }
\label { struct_ _ AI_ _ snort_ _ alert_ af8408be5da59cda853442dd13465c0f6}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a285aff12d6bac03c316ccc5305d28e53} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !grouped\_ \- alarms\_ \- count@{ grouped\_ \- alarms\_ \- count} }
\index { grouped\_ \- alarms\_ \- count@{ grouped\_ \- alarms\_ \- count} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{grouped\_\-alarms\_\-count}] { \setlength { \rightskip } { 0pt plus 5cm} unsigned int { \bf \_ \- AI\_ \- snort\_ \- alert::grouped\_ \- alarms\_ \- count} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a285aff12d6bac03c316ccc5305d28e53}
2010-09-11 12:45:30 +02:00
If the clustering algorithm is used, we also count how many alerts this single alert groups \hypertarget { struct_ _ AI_ _ snort_ _ alert_ ac53765584296ead1328eabfaba8a3aed} {
2010-08-16 22:09:34 +02:00
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !h\_ \- node@{ h\_ \- node} }
\index { h\_ \- node@{ h\_ \- node} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{h\_\-node}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf hierarchy\_ \- node} $ \ast $ { \bf \_ \- AI\_ \- snort\_ \- alert::h\_ \- node} \mbox { [} CLUSTER\_ \- TYPES\mbox { ]} } }
\label { struct_ _ AI_ _ snort_ _ alert_ ac53765584296ead1328eabfaba8a3aed}
2010-09-11 12:45:30 +02:00
Hierarchies for addresses and ports, if the clustering algorithm is used \hypertarget { struct_ _ AI_ _ snort_ _ alert_ ac101de15b4f9451f235b82122f77b62a} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !hyperalert@{ hyperalert} }
\index { hyperalert@{ hyperalert} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{hyperalert}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf AI\_ \- hyperalert\_ \- info} $ \ast $ { \bf \_ \- AI\_ \- snort\_ \- alert::hyperalert} } }
\label { struct_ _ AI_ _ snort_ _ alert_ ac101de15b4f9451f235b82122f77b62a}
Hyperalert information, pre-\/ conditions and post-\/ conditions \hypertarget { struct_ _ AI_ _ snort_ _ alert_ a754ca683593c838e4032fa8c13b1512b} {
2010-09-04 21:33:53 +02:00
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !ip\_ \- dst\_ \- addr@{ ip\_ \- dst\_ \- addr} }
\index { ip\_ \- dst\_ \- addr@{ ip\_ \- dst\_ \- addr} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{ip\_\-dst\_\-addr}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint32\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::ip\_ \- dst\_ \- addr} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a754ca683593c838e4032fa8c13b1512b}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a2fc673dec85a7b49dd16ac7c0bb1bb78} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !ip\_ \- id@{ ip\_ \- id} }
\index { ip\_ \- id@{ ip\_ \- id} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{ip\_\-id}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint16\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::ip\_ \- id} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a2fc673dec85a7b49dd16ac7c0bb1bb78}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ ad3ffe99036513d5f33b94d22fb84f8f1} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !ip\_ \- len@{ ip\_ \- len} }
\index { ip\_ \- len@{ ip\_ \- len} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{ip\_\-len}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint16\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::ip\_ \- len} } }
\label { struct_ _ AI_ _ snort_ _ alert_ ad3ffe99036513d5f33b94d22fb84f8f1}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a5ea7b250ac1c472f3ab57565b6df2536} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !ip\_ \- proto@{ ip\_ \- proto} }
\index { ip\_ \- proto@{ ip\_ \- proto} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{ip\_\-proto}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint8\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::ip\_ \- proto} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a5ea7b250ac1c472f3ab57565b6df2536}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a194117c57a52933d16a97838562bb611} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !ip\_ \- src\_ \- addr@{ ip\_ \- src\_ \- addr} }
\index { ip\_ \- src\_ \- addr@{ ip\_ \- src\_ \- addr} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{ip\_\-src\_\-addr}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint32\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::ip\_ \- src\_ \- addr} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a194117c57a52933d16a97838562bb611}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a3f3c47f9baf3229d067504a85873b416} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !ip\_ \- tos@{ ip\_ \- tos} }
\index { ip\_ \- tos@{ ip\_ \- tos} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{ip\_\-tos}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint8\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::ip\_ \- tos} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a3f3c47f9baf3229d067504a85873b416}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a3c9bbe84ec696cd58668a45799a66600} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !ip\_ \- ttl@{ ip\_ \- ttl} }
\index { ip\_ \- ttl@{ ip\_ \- ttl} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{ip\_\-ttl}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint8\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::ip\_ \- ttl} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a3c9bbe84ec696cd58668a45799a66600}
2010-09-14 19:24:03 +02:00
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a1f2d5e8cfd0e6321b977173d1e90cb68} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !n\_ \- derived\_ \- alerts@{ n\_ \- derived\_ \- alerts} }
\index { n\_ \- derived\_ \- alerts@{ n\_ \- derived\_ \- alerts} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{n\_\-derived\_\-alerts}] { \setlength { \rightskip } { 0pt plus 5cm} unsigned int { \bf \_ \- AI\_ \- snort\_ \- alert::n\_ \- derived\_ \- alerts} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a1f2d5e8cfd0e6321b977173d1e90cb68}
Number of derived alerts \hypertarget { struct_ _ AI_ _ snort_ _ alert_ aa8336d4b3359015ed8ea312ca1fd1173} {
2010-08-16 22:09:34 +02:00
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !next@{ next} }
\index { next@{ next} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{next}] { \setlength { \rightskip } { 0pt plus 5cm} struct { \bf \_ \- AI\_ \- snort\_ \- alert} $ \ast $ { \bf \_ \- AI\_ \- snort\_ \- alert::next} } }
\label { struct_ _ AI_ _ snort_ _ alert_ aa8336d4b3359015ed8ea312ca1fd1173}
2010-09-14 19:24:03 +02:00
Pointer to the next alert in the log, if any \hypertarget { struct_ _ AI_ _ snort_ _ alert_ a55a5488c7ee7706ded4c16b1235fd9c7} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !previous\_ \- correlated@{ previous\_ \- correlated} }
\index { previous\_ \- correlated@{ previous\_ \- correlated} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{previous\_\-correlated}] { \setlength { \rightskip } { 0pt plus 5cm} struct { \bf \_ \- AI\_ \- snort\_ \- alert} $ \ast $ { \bf \_ \- AI\_ \- snort\_ \- alert::previous\_ \- correlated} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a55a5488c7ee7706ded4c16b1235fd9c7}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a25661fa4e212c5e30af5e6a892985ec9} {
2010-08-16 22:09:34 +02:00
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !priority@{ priority} }
\index { priority@{ priority} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{priority}] { \setlength { \rightskip } { 0pt plus 5cm} unsigned short { \bf \_ \- AI\_ \- snort\_ \- alert::priority} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a25661fa4e212c5e30af5e6a892985ec9}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a864d3baa48586d6a31639f4cd27d9d37} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !rev@{ rev} }
\index { rev@{ rev} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{rev}] { \setlength { \rightskip } { 0pt plus 5cm} unsigned int { \bf \_ \- AI\_ \- snort\_ \- alert::rev} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a864d3baa48586d6a31639f4cd27d9d37}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a3349aa68d2234f8ffd897367c3a8a137} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !sid@{ sid} }
\index { sid@{ sid} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{sid}] { \setlength { \rightskip } { 0pt plus 5cm} unsigned int { \bf \_ \- AI\_ \- snort\_ \- alert::sid} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a3349aa68d2234f8ffd897367c3a8a137}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a09dfe0a841fd3912ec78060d4547cb31} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !stream@{ stream} }
\index { stream@{ stream} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{stream}] { \setlength { \rightskip } { 0pt plus 5cm} struct { \bf pkt\_ \- info} $ \ast $ { \bf \_ \- AI\_ \- snort\_ \- alert::stream} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a09dfe0a841fd3912ec78060d4547cb31}
2010-09-11 12:45:30 +02:00
Reference to the TCP stream associated to the alert, if any \hypertarget { struct_ _ AI_ _ snort_ _ alert_ a8aac577224a4325ec50511c6d79b4b79} {
2010-09-04 21:33:53 +02:00
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !tcp\_ \- ack@{ tcp\_ \- ack} }
\index { tcp\_ \- ack@{ tcp\_ \- ack} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{tcp\_\-ack}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint32\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::tcp\_ \- ack} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a8aac577224a4325ec50511c6d79b4b79}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ aaca31cb67d48ffc3bfd1227686d5f5a4} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !tcp\_ \- dst\_ \- port@{ tcp\_ \- dst\_ \- port} }
\index { tcp\_ \- dst\_ \- port@{ tcp\_ \- dst\_ \- port} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{tcp\_\-dst\_\-port}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint16\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::tcp\_ \- dst\_ \- port} } }
\label { struct_ _ AI_ _ snort_ _ alert_ aaca31cb67d48ffc3bfd1227686d5f5a4}
2010-08-16 22:09:34 +02:00
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ aa643f11db93b70242b57f0a04775e507} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !tcp\_ \- flags@{ tcp\_ \- flags} }
\index { tcp\_ \- flags@{ tcp\_ \- flags} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{tcp\_\-flags}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint8\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::tcp\_ \- flags} } }
\label { struct_ _ AI_ _ snort_ _ alert_ aa643f11db93b70242b57f0a04775e507}
2010-09-04 21:33:53 +02:00
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ ab7e0507050b8e475fea7a4b26c768857} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !tcp\_ \- len@{ tcp\_ \- len} }
\index { tcp\_ \- len@{ tcp\_ \- len} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{tcp\_\-len}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint16\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::tcp\_ \- len} } }
\label { struct_ _ AI_ _ snort_ _ alert_ ab7e0507050b8e475fea7a4b26c768857}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ ad6edf59fccea55bf5f940bf36117020b} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !tcp\_ \- seq@{ tcp\_ \- seq} }
\index { tcp\_ \- seq@{ tcp\_ \- seq} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{tcp\_\-seq}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint32\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::tcp\_ \- seq} } }
\label { struct_ _ AI_ _ snort_ _ alert_ ad6edf59fccea55bf5f940bf36117020b}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a4d4cbdbd9675f4c43545547f55174cb7} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !tcp\_ \- src\_ \- port@{ tcp\_ \- src\_ \- port} }
\index { tcp\_ \- src\_ \- port@{ tcp\_ \- src\_ \- port} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{tcp\_\-src\_\-port}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint16\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::tcp\_ \- src\_ \- port} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a4d4cbdbd9675f4c43545547f55174cb7}
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a1687fccc26bb211591db8b36ffec5348} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !tcp\_ \- window@{ tcp\_ \- window} }
\index { tcp\_ \- window@{ tcp\_ \- window} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{tcp\_\-window}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf uint16\_ \- t} { \bf \_ \- AI\_ \- snort\_ \- alert::tcp\_ \- window} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a1687fccc26bb211591db8b36ffec5348}
2010-08-16 22:09:34 +02:00
\hypertarget { struct_ _ AI_ _ snort_ _ alert_ a10a67f60ca3da339a2104849a0b2ac19} {
\index { \_ \- AI\_ \- snort\_ \- alert@{ \_ \- AI\_ \- snort\_ \- alert} !timestamp@{ timestamp} }
\index { timestamp@{ timestamp} !_ AI_ snort_ alert@{ \_ \- AI\_ \- snort\_ \- alert} }
\subsubsection [{timestamp}] { \setlength { \rightskip } { 0pt plus 5cm} time\_ \- t { \bf \_ \- AI\_ \- snort\_ \- alert::timestamp} } }
\label { struct_ _ AI_ _ snort_ _ alert_ a10a67f60ca3da339a2104849a0b2ac19}
The documentation for this struct was generated from the following file:\begin { DoxyCompactItemize}
\item
\hyperlink { spp_ _ ai_ 8h} { spp\_ \- ai.h} \end { DoxyCompactItemize}
