D-Link DFL-210 - NetDefend - Security Appliance, Справочное руководство по журналу операций, Страница: 31 / 476

1.2. Context Parameters
In many cases, information regarding a certain object is featured in the log message. This can be
information about, for example, a connection. In this case, the log message should, besides all the
normal log message attributes, also include information about which protocol is used, source and
destination IP addresses and ports (if applicable), and so on.
As the same information will be included in many log messages, these are referenced as a Context
Parameter. So whenever a log message includes information about a connection, it will feature the
CONN parameter in the Context Parameter list. This means that additional information about the
connection will also be included in the log message.
A description of all available context parameters follows with an explanation of all the additional
parameters. The names of the additional parameters are specified using the Syslog format.
ALG Module Name
An ALG is always of a certain type, for example FTP, H323 or HTTP. This parameter specifies the
name of the ALG sub-module, in order to quickly distinguish which type of ALG this is.
algmod The name of the ALG sub-module.
ALG Session ID
Each ALG session has its own session ID, which uniquely identifies an ALG session. This is useful,
for example, when matching the opening of an ALG session with the closure of the same ALG
session.
algsesid The session ID of an ALG session.
Packet Buffer
Information about the packet buffer, which in turn contains a large number of additional objects.
Certain parameters may or may not be included, depending on the type of packet buffer. For
example, the TCP flags are only included if the buffer contains a TCP protocol, and the
ICMP-specific parameters are only included if the buffer contains a ICMP protocol.
recvif The name of the receiving interface.
[hwsender] The sender hardware address. Valid if the protocol is ARP.
[hwdest]
The destination hardware address. Valid if the protocol is ARP.
[arp] The ARP state. Valid if the protocol is ARP. Possible values: request|reply.
[srcip] The source IP Address. Valid if the protocol is not ARP.
[destip] The destination IP Address. Valid if the protocol is not ARP.
iphdrlen The IP header length.
[fragoffs] Fragmentation offset. Valid if the IP packet is fragmented.
[fragid] Fragmentation ID. Valid if the IP packet is fragmented.
ipproto The IP Protocol.
ipdatalen
The IP data length.
1.2. Context Parameters Chapter 1. Introduction
31