Field name |
Description |
Type |
ip
|
IPv4
|
No value (only supports checking if file exists or not)
|
ip.ver
|
Version
|
Numeric (signed/unsigned Integer) value
|
ip.ihl
|
Header Length
|
Numeric (signed/unsigned Integer) value
|
ip.diff
|
Differentiated Services Field
|
No value (only supports checking if file exists or not)
|
ip.diff.dscp
|
Differentiated Services Codepoint
|
Signed/Unsigned Integer Value
|
ip.diff.ecn
|
Explicit Congestion Notification
|
Signed/Unsigned Integer Value
|
ip.length
|
Total Length
|
Unsigned Integer, 2 byte
|
ip.identification
|
Identification
|
Unsigned Integer, 2 byte
|
ip.flags
|
Flags
|
Unsigned Integer, 2 byte
|
ip.flags.reserved
|
Reserved Bit
|
Signed/Unsigned Integer Value
|
ip.flags.dfragment
|
Don't Fragment
|
Signed/Unsigned Integer Value
|
ip.flags.mfragment
|
More Fragments
|
Signed/Unsigned Integer Value
|
ip.flags.fragment
|
Fragment Offset
|
Numeric (signed/unsigned Integer) value
|
ip.ttl
|
Time To Live
|
Unsigned Integer, 1 byte
|
ip.proto
|
Transport Protocol
|
Signed/Unsigned Integer Value
|
ip.checksum
|
Header Checksum
|
Unsigned Integer, 2 byte
|
ip.src
|
Source
|
IPv4 Address
|
ip.dst
|
Destination
|
IPv4 Address
|
ip.opt
|
IP Option
|
No value (only supports checking if file exists or not)
|
ip.opt.type
|
Type
|
Unsigned Integer, 1 byte
|
ip.opt.type.copy
|
Copy On Fragmentation
|
Signed/Unsigned Integer Value
|
ip.opt.type.class
|
Class
|
Signed/Unsigned Integer Value
|
ip.opt.type.number
|
Number
|
Signed/Unsigned Integer Value
|
ip.opt.length
|
Length
|
Unsigned Integer, 1 byte
|
ip.opt.data
|
Data
|
String of hexadecimal bytes
|
ip.opt.pad
|
Padding
|
String of hexadecimal bytes
|
ip.opt.sec_rfc791_sec
|
Security
|
Signed/Unsigned Integer Value
|
ip.opt.sec_rfc791_comp
|
Compartments
|
Unsigned Integer, 2 byte
|
ip.opt.sec_rfc791_hr
|
Handling Restrictions
|
String value
|
ip.opt.sec_rfc791_tcc
|
Transmission Control Code
|
String value
|
ip.opt.sec_cl
|
Classification Level
|
Signed/Unsigned Integer Value
|
ip.opt.sec_prot_auth_flags
|
Protection Authority Flags
|
Unsigned Integer, 1 byte
|
ip.opt.sec_prot_auth_genser
|
GENSER
|
Signed/Unsigned Integer Value
|
ip.opt.sec_prot_auth_siop_esi
|
SIOP-ESI
|
Signed/Unsigned Integer Value
|
ip.opt.sec_prot_auth_sci
|
SCI
|
Signed/Unsigned Integer Value
|
ip.opt.sec_prot_auth_nsa
|
NSA
|
Signed/Unsigned Integer Value
|
ip.opt.sec_prot_auth_doe
|
DOE
|
Signed/Unsigned Integer Value
|
ip.opt.sec_prot_auth_unassigned
|
Unassigned
|
Numeric (signed/unsigned Integer) value
|
ip.opt.sec_prot_auth_fti
|
Field Termination Indicator
|
Signed/Unsigned Integer Value
|
ip.opt.ext_sec_add_sec_info_format_code
|
Additional Security Info Format Code
|
Unsigned Integer, 1 byte
|
ip.opt.ext_sec_add_sec_info
|
Additional Security Info
|
String of hexadecimal bytes
|
ip.opt.sr.pointer
|
Pointer
|
Unsigned Integer, 1 byte
|
ip.opt.sr.address_list
|
Address List
|
No value (only supports checking if file exists or not)
|
ip.opt.sr.address
|
Router Address
|
IPv4 Address
|
ip.opt.timestamp.overflow
|
Overflow
|
Numeric (signed/unsigned Integer) value
|
ip.opt.timestamp.flags
|
Flags
|
Signed/Unsigned Integer Value
|
ip.opt.timestamp
|
Timestamps
|
No value (only supports checking if file exists or not)
|
ip.opt.timestamp.address
|
Address
|
IPv4 Address
|
ip.opt.timestamp.timestamp
|
Timestamp
|
Unsigned Integer, 4 byte
|
ip.opt.ra
|
Router Alert
|
Signed/Unsigned Integer Value
|
ip.opt.sid
|
Stream Identifier
|
Unsigned Integer, 2 byte
|
ip.opt.id_number
|
ID Number
|
Unsigned Integer, 2 byte
|
ip.opt.ohc
|
Outbound Hop Count
|
Unsigned Integer, 2 byte
|
ip.opt.rhc
|
Return Hop Count
|
Unsigned Integer, 2 byte
|