<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE lire:report-spec PUBLIC
  "-//LogReport.ORG//DTD Lire Report Specification Markup Language V1.0//EN"
  "http://www.logreport.org/LRSML/1.0/lrsml.dtd">
<lire:report-spec xmlns:lire="http://www.logreport.org/LRSML/"
 superservice="firewall" id="deniedtcpperport" charttype="bars">

 <lire:title>
  Top blocked tcp packets per source IP per destination port Report
 </lire:title>
 <lire:description>
  <para>
    This report lists the destination ports for which we blocked the
    highest tcp data volume, along with the sending ip adresses
  </para>
 </lire:description>

 <lire:param-spec>
  <lire:param name="ips_to_show" type="int" default="10">
   <lire:description>
    <para>This parameter controls the number of sending IP adresses to
     display in the report.
    </para>
   </lire:description>
  </lire:param>
  <lire:param name="ports_to_show" type="int" default="10">
   <lire:description>
    <para>This parameter controls the number of destination ports to display
     in the report.
    </para>
   </lire:description>
  </lire:param>
 </lire:param-spec>

 <lire:display-spec>
  <lire:title>
   Volume per sending IP, per destination port, blocked TCP Packets,
    Top $ips_to_show IPs, Top $ports_to_show ports
  </lire:title>
 </lire:display-spec>

 <!--
    The match expression element tries to match a POSIX 1003.2
    extended regular expression to a value and return true if there is
    a match and false otherwise.

    Attributes of match:
        value:          The value which should matched.
        re:             A POSIX 1003.2 extended regular expression.
        case-sensitive: Is the regex sensitive to case. Defaults to true.
                                                                     -->

 <lire:filter-spec>
  <!-- we might have re="denied|someipfilterequivalent" -->
  <!-- <lire:match value="action" re="denied" case-sensitive="no"/> -->
  <lire:and>
   <lire:eq arg1="$action" arg2="denied"/>
   <lire:eq arg1="$protocol" arg2="tcp"/>
  </lire:and>
 </lire:filter-spec>

 <lire:report-calc-spec>
  <lire:group sort="-volume" limit="$ports_to_show">
   <lire:field name="to_port"/>
   <lire:sum name="volume" field="length"/>

   <lire:group sort="-ip_volume" limit="$ips_to_show">
    <lire:field name="from_ip"/>
    <lire:sum name="ip_volume" field="length"/>
   </lire:group>
  </lire:group>
 </lire:report-calc-spec>

</lire:report-spec>

