# classification file for argus logs

PROTO TCP DADDR any DPORT eq 5554 CLASS "Prelude IDS Traffic" URL "http://www.intrusion-lab.net/class/0012-prelude-ids-traffic.html" SEVERITY info ACTION log
PROTO any SADDR any DADDR any DPORT eq 123 CLASS "NTP Traffic" URL "http://www.intrusion-lab.net/0011-ntp-traffic.html" SEVERITY info ACTION log
PROTO any SADDR any DADDR any DPORT eq 993 CLASS "IMAP SSL Traffic" URL "http://www.intrusion-lab.net/class/0010-imapssl-traffic.html" SEVERITY info ACTION log
PROTO any SADDR any DADDR any DPORT eq 445 CLASS "Microsoft DS" URL "http://www.intrusion-lab.net/class/0009-microsoft-ds.html" SEVERITY info ACTION log
PROTO any SADDR any DADDR any DPORT range 137 139 CLASS "Netbios Traffic" URL "http://www.intrusion-lab.net/class/0008-netbios-traffic.html" SEVERITY info ACTION log
PROTO TCP SADDR any DADDR any DPORT eq 80 CLASS "WWW Traffic" URL "http://www.intrusion-lab.net/class/0007-www-traffic.html" SEVERITY info ACTION log
PROTO TCP SADDR any DADDR any DPORT eq 25 CLASS "Telnet Traffic" URL "http://www.intrusion-lab.net/class/0006-telnet-traffic.html" SEVERITY info ACTION log
PROTO any SADDR any DADDR any DPORT eq 53 CLASS "DNS Traffic" URL "http://www.intrusion-lab.net/class/0005-dns-traffic.html" SEVERITY info ACTION log
PROTO UDP SADDR any DADDR any DPORT eq 162 CLASS "SNMPTRAP Traffic" URL "http://www.intrusion-lab.net/class/0004-snmptrap-traffic.html" SEVERITY info ACTION log
PROTO ICMP SADDR any DADDR any ITYPE 8 CLASS "ICMP Echo" URL "http://www.intrusion-lab.net/class/0003-icmp-echo-traffic.html" SEVERITY info ACTION log
PROTO ICMP SADDR any DADDR any CLASS "ICMP Traffic" URL "http://www.intrusion-lab.net/class/0002-icmp-traffic.html" SEVERITY info ACTION log
SADDR any DADDR any CLASS "Unknown Network Traffic" URL "http://www.intrusion-lab.net/class/0001-unknown-traffic.html" SEVERITY medium ACTION store