Both normal use and attack sessions will be present. Distributions of normal session types and normal session content will be similar to that on military bases. Attack sessions will contain recent attacks and the types of behaviors observed during illegal computer use. This data contains the contents of every packet transmitted between computers inside and outside a simulated military base. Documentation on how tcpdump was invoked will also be provided.
White space separates the fields.
Newlines separate the records. The listfile will only contain information on a subset of the data in the tcpdump file. This data contains audit information describing system calls made to the Solaris kernel. Again, only a subset of the network sessions captured by BSM will be called out in the listfile. A postscript block diagram of the simulation network, showing the logical organization of the machines and routers relative to each other.