<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE lire:dlf-schema PUBLIC
  "-//LogReport.ORG//DTD Lire DLF Schema Markup Language V1.0//EN"
  "http://www.logreport.org/LDSML/1.0/ldsml.dtd">

<!-- $Id: firewall.xml,v 1.6 2002/07/14 21:08:08 flacoste Exp $ -->

<lire:dlf-schema superservice="firewall" timestamp="time"
 xmlns:lire="http://www.logreport.org/LDSML/">

 <lire:title>DLF Schema for Firewall service</lire:title>
 <lire:description>
  <para>The <type>firewall</type> schema can be used for three types
   of logs: packet filtering firewall, intrusion detection system
   events and packet accounting devices.
  </para>
 </lire:description>

 <lire:field name="time"                type="timestamp">
  <lire:description>
   <para>The time of the event.</para>
  </lire:description>
 </lire:field>

 <!-- e.g. denied or permitted (these are the cisco names for this field) -->
 <lire:field name="action"              type="string">
  <lire:description>
   <para>What action was associated with that packet. Either
    <constant>denied</constant> or
    <constant>permitted</constant>. 
   </para>
  </lire:description>
 </lire:field>

 <!-- e.g. tcp, udp, icmp, etc. -->
 <lire:field name="protocol"            type="string">
  <lire:description>
   <para>The procotol of the packet. Common protocols are
    <type>TCP</type>, <type>UDP</type> or <type>ICMP</type>. This
    should be the <type>IP</type> protocol not higer-level application
    protocol.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="from_ip"             type="ip">
  <lire:description>
   <para>The source ip address on the packet.</para>
  </lire:description>
 </lire:field>

 <lire:field name="from_port"           type="port">
  <lire:description>
   <para>The source port (in the case of the TCP or UDP) protocol.
    This should be the ICMP type when the protocol is ICMP.</para>
  </lire:description>
 </lire:field>

 <lire:field name="from_host"           type="hostname">
  <lire:description>
   <para>The hostname associated with the source IP.</para>
  </lire:description>
 </lire:field>

 <lire:field name="rcv_intf"            type="string">
  <lire:description>
   <para>The receiving interface. That should be the network interface
    on which the packet was received. That field should contains the
    logical name or type of the interface.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="rcv_hwaddr"          type="string">
  <lire:description>
   <para>The hardware address of the receiving interface. That's the
    MAC address in the case of an ethernet device.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="to_ip"               type="ip">
  <lire:description>
   <para>The destination ip address on the packet.</para>
  </lire:description>
 </lire:field>

 <lire:field name="to_port"             type="port">
  <lire:description>
   <para>The destination port (in the case of the TCP or UDP) protocol.
    This should be the ICMP code when the protocol is ICMP.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="to_host"           type="hostname">
  <lire:description>
   <para>The hostname associated with the destination IP.</para>
  </lire:description>
 </lire:field>

 <lire:field name="snt_intf"            type="string" default="-">
  <lire:description>
   <para>The sending interface. That should be the network interface
    on which the packet was sent (i.e. the outgoing interface).
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="length"              type="bytes" default="0">
  <lire:description>
   <para>The packet length (that is the header and payload length).
    This should be the total length of the stream when the
    event represent multiple packets, for example, in the case of
    packet accounting done on streams.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="rule"		type="string" default="-">
  <lire:description>
   <para>The rule that triggered that packet to be logged, denied,
    permitted, etc.</para>
  </lire:description>
 </lire:field>

 <lire:field name="msg"			type="string" default="-">
  <lire:description>
   <para>A message associated with that packet. This could be an
    attack signature detected by a Network Intrusion Detection System
    or anything of similar nature.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="count"		type="int" default="1">
  <lire:description>
   <para>The number of packets described by this event. This will be 1
    in the case of a single packet. It can be higher in the case where
    multiple packets are compressed into one event. Remember that the
    <type>length</type> values should reflect the length of all those packets.
   </para>
  </lire:description>
 </lire:field>
</lire:dlf-schema>

