<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE lire:report-spec PUBLIC
  "-//LogReport.ORG//DTD Lire Report Specification Markup Language V1.0//EN"
  "http://www.logreport.org/LRSML/1.0/lrsml.dtd">
<lire:report-spec xmlns:lire="http://www.logreport.org/LRSML/"
 superservice="firewall" id="top-bytes-dst-by-src">

 <lire:title>Top Volume to Destination by Source Firewall Report</lire:title>
 <lire:description>
  <para>This report will show for a number of source IP addresses that
   sent the most volume of traffic, the list of destination (destination IP and
   destination port).
  </para>
 </lire:description>

 <lire:param-spec>
  <lire:param name="src_to_show" type="int" default="15">
   <lire:description>
    <para>This parameter controls the number of source IP adresses
     to display in the report.
    </para>
   </lire:description>
  </lire:param>
  <lire:param name="dst_to_show" type="int" default="20">
   <lire:description>
    <para>This parameter controls the number of destination (IP
     address and port) to display for each source IP.
    </para>
   </lire:description>
  </lire:param>
 </lire:param-spec>

 <lire:display-spec>
  <lire:title>Top Source IPs (in Volume of Traffic) by Destination, Top $src_to_show, Top $dst_to_show destinations</lire:title>
 </lire:display-spec>

 <lire:report-calc-spec>
  <lire:group sort="-vol" limit="$src_to_show">
   <lire:field name="from_ip"/>
   <lire:sum name="vol" field="length"/>
   <lire:group sort="-dst_vol" limit="$dst_to_show">
    <lire:field name="to_ip"/>
    <lire:field name="protocol"/>
    <lire:field name="to_port"/>
    <lire:sum name="dst_vol" field="length"/>
   </lire:group>
  </lire:group>
 </lire:report-calc-spec>

</lire:report-spec>

