The NetworkPacketObjectChoiceType is the type of the Has_Choice property. In the UML model, this class is associated with the <<choice>> UML stereotype, which specifies that only one of the available properties of the NetworkPacketObjectChoiceType class can be populated at any time. The property table of the NetworkPacketObjectChoiceType class is given in Table 32. Table . Properties of the NetworkPacketObjectChoiceType class Name Type Multiplicity Description Link_Layer LinkLayerType 0..1 The Link_Layer property is the lowest layer of the TCP/IP network stack and is comprised of physical and logical protocols that operate between adjacent nodes of a network segment or a WAN connection. Only one of the properties of NetworkPacketObjectChoiceType can be populated. Internet_Layer InternetLayerType 0..1 The Internet_Layer property characterizes information the network layer of this packet, as defined in the 7-layer OSI model. See for more details. Only one of the properties of NetworkPacketObjectChoiceType can be populated. Transport_Layer TransportLayerType 0..1 The Transport_Layer property characterizes information about the transport layer of this packet as defined in the 7-layer OSI model. See for more details. Only one of the properties of NetworkPacketObjectChoiceType can be populated. LinkLayerType Class The LinkLayerType class characterizes the link layer protocol, which is a hardware interface protocol, such as Ethernet, or a logical link routing protocol, such as ARP. The UML diagram corresponding to the LinkLayerObjectType class is shown in Figure 31. The property table of the LinkLayerType class is given in Table 33.
Table . Properties of the LinkLayerType class Name Type Multiplicity Description Has_Choice LinkLayerChoiceType 1 The Has_Choice property is associated with the class LinkLayerChoiceType. It indicates that there is a choice among the Physical_Interface property and the Logical_Protocols property. Only one of the properties of LinkLayerChoiceType class can be populated at any time. See Section 1.2.3 for more detail. The LinkLayerChoiceType class is the type of the Has_Choice property. In the UML model, this class is associated with the <<choice>> UML stereotype, which specifies that only one of the available properties of the LinkLayerChoiceType class can be populated at any time. The property table of the LinkLayerChoiceType class is given in Table 34. Table . Properties of the LinkLayerChoiceType class Name Type Multiplicity Description Physical_Interface PhysicalInterfaceType 0..1 The Physical_Interface property characterizes one hardware interface of a link layer connection. Only one of the properties of LinkLayerChoiceType can be populated. Logical_Protocols LogicalProtocolType 0..1 The Logical_Protocols property characterizes the logical protocol of a link layer connection. One example of a logical protocol is ARP. Only one of the properties of LinkLayerChoiceType can be populated. LogicalProtocolType Class The LogicalProtocolType class characterizes the logical protocol of a link layer connection. One example of a logical protocol is ARP.
NDP NDPType 0..1 The NDP property specifies the Neighbor Discovery Protocol, which is used with IPv6 to determine the link-layer addresses for neighbors. It corresponds to a combination of IPv4 protocols: ARP, ICMP Router Discovery, and ICMP Redirect. Only one of the properties of LogicalProtocolChoiceType can be populated. ARPType Class The ARPType class characterizes the Address Resolution Protocol, which is a request and reply protocol that runs encapsulated by the line protocol. It is communicated within the boundaries of a single network, and never routed across inter-network nodes. This property places ARP into the Link Layer. See for more information. The property table of the ARPType class is given in Table 37. Table . Properties of the ARPType class Name Type Multiplicity Description Hardware_Addr_Type IANAHardwareType 0..1 The Hardware_Addr_Type property characterizes the type of hardware address specified in an ARP message. Proto_Addr_Type IANAEtherType 0..1 The Proto_Addr_Type property characterizes the type of protocol address being mapped. For IPv4 addresses, the value is 0x0800. Hardware_Addr_Size cyboxCommon: HexBinaryObjectPropertyType 0..1 The Hardware_Addr_Size property represents the byte size of the hardware address. For Ethernet or other IEEE 802 MAC addresses, the value is 6. Proto_Addr_Size cyboxCommon: HexBinaryObjectPropertyType 0..1 The Proto_Addr_Size property represents the byte size of the protocol address. For IPv4 addresses, the value is 4.
Hosts send Router Solicitations in order to prompt routers to generate Router Advertisements quickly (type=133; code=0). Only one of the Router_Solicitation, Router_Advertisement, Neighbor_Solicitation, Neighbor_Advertisement and Redirect properties can be populated. Router_Advertisement RouterAdvertisementType 0..1 The Router_Advertisement property is used to specify a RouterAdvertisementType form of the NDPType class. Routers send out Router Advertisement messages periodically, or in response to Router Solicitations (type=134; code=0). Only one of the Router_Solicitation, Router_Advertisement, Neighbor_Solicitation, Neighbor_Advertisement and Redirect properties can be populated. Neighbor_Solicitation NeighborSolicitationType 0..1 The Neighbor_Solicitation property is used to specify a NeighborSolicitationType form of the NDPType Nodes send Neighbor Solicitations to request the link-layer address of a target node while also providing their own address to the target. Neighbor Solicitations are multicast when the node needs to resolve an address and unicast when the node seeks to verify the reachability of a neighbor (type=135; code=0). Only one of the Router_Solicitation, Router_Advertisement, Neighbor_Solicitation, Neighbor_Advertisement and Redirect properties can be populated. Neighbor_Advertisement NeighborAdvertisementType 0..1 The Neighbor_Advertisement property is used to specify a NeighborAdvertisementType form of the NDPType class.
Options RouterSolicitationOptionsType 0..* The Options property - Router Solicitation messages include zero or more options, some of which may appear multiple times in the same message. RouterSolicitationOptionsType Class The RouterSolicitationOptionsType class specifies zero or more options for a Router Solicitation packet, some of which may appear multiple times in the same message. The property table of the RouterSolicitationOptionsType class is given in Table 311. Table . Properties of the RouterSolicitationOptionsType class Name Type Multiplicity Description Src_Link_Addr NDPLinkAddrType 0..1 The Src_Link_Addr property characterizes the Source Link-Layer Address option. RouterAdvertisementType Class The RouterAdvertisementType specifies a NDP packet which routers send periodically, or in response to Router Solicitations (class=134; code=0). The property of the RouterAdvertisementType class is given in Table 312. Table . Properties of the RouterAdvertisementType class Name Type Multiplicity Description managed_address_ config_flag basicDataTypes:Boolean 0..1 The managed_address_config_flag property specifies the 1-bit "Managed address configuration" flag. When set, it indicates that addresses are available via Dynamic Host Configuration Protocol. If the M flag is set, the O flag is redundant and can be ignored because DHCPv6 will return all available configuration information.
PrefixType Class The PrefixType class characterizes an IP address or a prefix of an IP address for IPv6. The property of the PrefixType class is given in Table 317. Table . Properties of the PrefixType class Name Type Multiplicity Description IPv6_Addr AddressObj:AddressObjectType 0..1 The IPv6_Addr property specifies the IPv6 address. IP_Addr_Prefix AddressObj:AddressObjectType 0..1 The IP_Addr_Prefix property specifies the initial bits of an IPv6 address (these are identical for all hosts in a network) from the network's prefix. See for more information. NeighborSolicitationType The NeighborSolicitationType class specifies a NDP packet which nodes send to request the link-layer address of a target node while also providing their own link-layer address to the target. Neighbor Solicitations are multicast when the node needs to resolve an address and unicast when the node seeks to verify the reachability of a neighbor (class=135; code=0). The property of the NeighborSolicitationType class is given in Table 318. Table . Properties of the NeighborSolicitationType class Name Type Multiplicity Description Target_IPv6_Addr AddressObj:AddressObjectType 0..1 The Target_IPv6_Addr property specifies the IP address of the target of the solicitation. Options NeighborSolicitationOptionsType 0..1 The Options property specifies zero or more options, some of which may appear multiple times in the same message.
NeighborSolicitationOptionsType Class The NeighborSolicitationOptionsType class specifies zero or more options of a Neighbor Solicitation packet, some of which may appear multiple times in the same message. The property table of the NeighborSolicitationOptionsType class is given in Table 319. Table . Properties of the NeighborSolicitationOptionsType class Name Type Multiplicity Description Src_Link_Addr NDPLinkAddrType 0..1 The Src_Link_Addr property characterizes the Source Link-Layer Address option. NeighborAdvertisementType Class The NeighborAdvertisementType specifies a NDP packet which a node sends in response to Neighbor Solicitations and sends unsolicited Neighbor Advertisements in order to (unreliably) propagate new information quickly (class=136; code=0). The property table of the NeighborAdvertisementType class is given in Table 320. Table . Properties of the NeighborAdvertisementType class Name Type Multiplicity Description router_flag basicDataTypes: Boolean 0..1 The router_flag property specifies the router flag (R-bit). When set, the indicates that the sender is a router. The R-bit is used by Neighbor Unreachability Detection to detect a router that changes to a host. solicited_flag basicDataTypes: Boolean 0..1 The solicited_flag property specifies the solicited flag (S-bit). When set, the S-bit indicates that the advertisement was sent in response to a Neighbor Solicitation from the Destination address. The S-bit is used as a reachability confirmation for Neighbor Unreachability Detection.
EthernetInterfaceType The EthernetInterfaceType class characterizes the Ethernet interface, which is used to send network packets from the sending host to one or more receiving hosts. See and for more information. The property table of the EthernetInterfaceType class is given in Table 326. . Properties of the EthernetInterfaceType class Name Type Multiplicity Description Ethernet_Header EthernetHeaderType 0..1 The Ethernet_Header property includes information such as source MAC address, destination MAC address, and more. EthernetHeaderType Class The EthernetHeaderType class characterizes the Ethernet header and includes information such as source MAC address, destination MAC address, and more. The property table of the EthernetHeaderType class is given in Table 327. Table . Properties of the EthernetHeaderType class Name Type Multiplicity Description Destination_MAC_Addr AddressObj: AddressObjectType 0..1 The Destination_MAC_Addr property characterizes the destination MAC Address of the Ethernet frame. Source_MAC_Addr AddressObj: AddressObjectType 0..1 The Source_MAC_Addr property characterizes the source MAC Address of the Ethernet frame.
Table . Properties of the InternetLayerType class Name Type Multiplicity Description Has_Choice InternetLayerChoiceType 1 The Has_Choice property is associated with the class InternetLayerChoiceType. It indicates that there is a choice among IPv4, ICMPv4, IPv6 and ICMPv6 properties. Only one of the properties of InternetLayerChoiceType class can be populated at any time. See Section 1.2.3 for more detail. The InternetLayerChoiceType class is the type of the Has_Choice property. In the UML model, this class is associated with the <<choice>> UML stereotype, which specifies that only one of the available properties of the InternetLayerChoiceType class can be populated at any time. The property table of the InternetLayerChoiceType class is given in Table 330. . Properties of the InternetLayerChoiceType class Name Type Multiplicity Description IPv4 IPv4PacketType 0..1 The IPv4 property specifies the Internet Protocol version 4 (IPv4) packet. IPv4 is a connectionless protocol for use on packet-switched link networks (e.g., Ethernet). Only one of the properties of InternetLayerChoiceType can be populated. ICMPv4 ICMPv4PacketType 0..1 The ICMPv4 property specifies an ICMP packet (v4) which is chiefly used in the operating systems of networked computers to send error messages indicating, for example, that a requested service is not available or that a host or router could not be reached. See and for more information.
FragmentHeaderType The FragmentHeaderType class characterizes each fragment with a header containing next header information, the offset of the fragment, an M flag specifying whether or not it is the last fragment, and an identification value. The property table of the FragmentHeaderType class is given in Table 344. . Properties of the FragmentHeaderType class Name Type Multiplicity Description Next_Header cyboxCommon: HexBinaryObjectPropertyType 0..1 The Next_Header property specifies the type of header immediately following the Fragment header. Uses the same values as the IPv4 Protocol property. Fragment_Offset cyboxCommon: HexBinaryObjectPropertyType 0..1 The Fragment_Offset property specifies a 13-bit unsigned integer which is the offset, in 8-octet units, of the data following this header relative to the start of the Fragmentable Part or the original packet. M_Flag MFlagType 0..1 The M_Flag property specifies whether this is the last fragment or whether there are more fragments. Identification cyboxCommon: HexBinaryObjectPropertyType 0..1 The Identification property specifies a 32-bit Identification value for the packet generated by the source node. MFlagType Data Type The MFlagType data type specifies whether there are more fragments. Its core value SHOULD be a literal found in the MFlagTypeEnum enumeration. Its base type is the BaseObjectPropertyType data type, in order to permit complex (i.e. regular-expression based) specifications. DestinationOptionsType Class The DestinationOptionsType class specifies the properties for the IPv6 Destination Options header which is used to carry optional information that needs to be examined only by a packet's destination node(s).
The property table of the DestinationOptionsType class is given in Table 345. . Properties of the DestinationOptionsType class Name Type Multiplicity Description Next_Header IANAAssignedIPNumbersType 0..1 The Next_Header property specifies the type of header immediately following the Destination_Options options header. Uses the same values as the IPv4 Protocol property. Header_Ext_Len cyboxCommon: HexBinaryObjectPropertyType 0..1 The Header_Ext_Len property specifies the length of the Destination Options header in 8-octet units, not including the first 8 octets. Option_Data OptionDataType 0..* The Option_Data property specifies a variable-length property of length such that the complete Destinations Options header is an integer multiple of 8 octets long. Contains one or more (TLV)-encoded options. AuthenticationHeaderType Class The AuthenticationHeaderType class is used to provide connectionless integrity and data origin authentication for IP datagrams and to provide protection against replays. See for more information. The property table of the AuthenticationHeaderType class is given in Table 346. Table . Properties of the AuthenticationHeaderType class Name Type Multiplicity Description Next_Header IANAAssignedIPNumbersType 0..1 The Next_Header property specifies the type of header immediately following the Authentication header. Uses the same values as the IPv4 Protocol property.
Header_Ext_Len cyboxCommon: HexBinaryObjectPropertyType 0..1 The Header_Ext_Len property is an 8-bit property specifying the length of the AH in 32-bit words. Security_Parameters_Index cyboxCommon: HexBinaryObjectPropertyType 0..1 The Security_Parameters_Index (SPI) property is an arbitrary 32-bit value that, in combination with the destination IP address and security protocol (AH), uniquely identifies the Security Association for this datagram. The set of SPI values in the range 1 through 255 are reserved by the Internet Assigned Numbers Authority (IANA) for future use. Sequence_Number cyboxCommon: HexBinaryObjectPropertyType 0..1 The Sequence_Number property specifies the unsigned 32-bit property containing a monotonically increasing counter value (sequence number). Authentication_Data cyboxCommon: HexBinaryObjectPropertyType 0..1 The Authentication_Data property specifies a variable-length property that contains the Integrity Check Value (ICV) for this packet. The field must be an integer multiple of 32 bits in length. EncapsulatingSecurityPayloadType Class The EncapsulatingSecurityPayloadType (ESP) class is used to provide confidentiality, data origin authentication, connectionless integrity, an anti-replay service (a form of partial sequence integrity), and limited traffic flow confidentiality. See for more information. The property table of the EncapsulatingSecurityPayloadType class is given in Table 347. Table . Properties of the EncapsulatingSecurityPayloadType class Name Type Multiplicity Description Security_Parameters_Index cyboxCommon: HexBinaryObjectPropertyType 0..1 The Security_Parameters_Index (SPI) property is an arbitrary 32-bit value that, in combination with the destination IP address and security protocol (ESP),
uniquely identifies the Security Association for this datagram. Sequence_Number cyboxCommon: HexBinaryObjectPropertyType 0..1 The Sequence_Number property is an unsigned 32-bit integer that contains a monotonically increasing counter value (sequence number). Payload_Data cyboxCommon: HexBinaryObjectPropertyType 0..1 The Payload_Data property specifies a variable-length property containing data described by the Next_Header property. Padding cyboxCommon: HexBinaryObjectPropertyType 0..1 The Padding property specifies the contents that can be used for various reasons, such as to fill in the plaintext as required by an encryption algorithm or to conceal the actual length of the payload. Padding_Len cyboxCommon: HexBinaryObjectPropertyType 0..1 The Padding_Len property specifies the number of pad bytes immediately preceding it. Range is 0-255, where a value of zero indicates that no padding bytes are present. Next_Header IANAAssignedIPNumbersType 0..1 The Next_Header property specifies the type data contained in the Payload_Data property. Uses the same values as the IPv4 Protocol Authentication_Data cyboxCommon: HexBinaryObjectPropertyType 0..1 The Authentication_Data property is a property containing an Integrity Check Value (ICV) computed over the ESP packet minus the Authentication Data. IPv6OptionType The IPv6OptionType class characterizes the meaning of each bit of the 8-bit IPv6 Options. The property table of the IPv6OptionType class is given in Table 348.
Info_Msg ICMPv4InfoMessageType 0..1 The Info_Msg property is used to specify an ICMPv4InfoMessageType form of the ICMPv4PacketType class. Only one of the Error_Msg, Info_Msg and Traceroute properties can be populated. Traceroute ICMPv4TracerouteType 0..1 The Traceroute property is used to specify an ICMPv4TracerouteType form of the ICMPv4PacketType Only one of the Error_Msg, Info_Msg and Traceroute properties can be populated. ICMPv4HeaderType The ICMPv4HeaderType class specify the actual ICMP header bytes corresponding to the ICMP class, ICMP code, and to the checksum. The property table of the ICMPv4HeaderType class is given in Table 351. Table . Properties of the ICMPv4HeaderType class Name Type Multiplicity Description Type cyboxCommon: HexBinaryObjectPropertyType 0..1 The Type property specifies the format of the ICMP message. Code cyboxCommon: HexBinaryObjectPropertyType 0..1 The Code property specifies the code of the ICMP message. Checksum cyboxCommon: HexBinaryObjectPropertyType 0..1 The Checksum property specifies the checksum (16 bits) of the ICMP message.
ICMPv4ErrorMessageType Class The ICMPv4ErrorMessageType class specifies ICMP error messages, which include destination unreachable messages, source quench messages, redirect messages, and time exceeded messages. The UML diagram corresponding to the ICMPv4ErrorMessageType class is shown in Figure 38. Figure . UML diagram of the ICMPv4ErrorMessageType class The property table of the ICMPv4ErrorMessageType class is given in Table 352. Table . Properties of the ICMPv4ErrorMessageType class Name Type Multiplicity Description Error_Msg_Content ICMPv4ErrorMessageContentType 0..1 The Error_Msg_Content property specifies content common to all ICMP error message types are defined here. Properties that are specific to individual message types are defined separately under each message type. Has_Choice ICMPv4ErrorMessageChoiceType 0..1 The Has_Choice property is associated with the class ICMPv4ErrorMessageChoiceType. It indicates that there is a choice among Destination_Unreachable, Source_Quench, Redirect_Message and Time_Exceeded properties. Only one of the properties of ICMPv4ErrorMessageChoiceType can be populated at any time. See Section 1.2.3 for more detail. The ICMPv4ErrorMessageChoiceType class is the type of the Has_Choice property. In the UML model, this class is associated with the <<choice>> UML stereotype, which specifies that only one of the available properties of the ICMPv4ErrorMessageChoiceType class can be populated at any time. The property table of the ICMPv4ErrorMessageChoiceType class is given in Table 353. Table . Properties of the ICMPv4ErrorMessageChoiceType class
Time_Exceeded ICMPv4TimeExceededType 0..1 The Time_Exceeded property specifies a time exceeded message, which is generated by a gateway to inform the source of a datagram that the datagram has been discarded due to the time to live property reaching zero. A time exceeded message may also be sent by a host if it fails to reassemble a fragmented datagram within its time limit. See for more information. Only one of the Destination_Unreachable, Source_Quench, Redirect_Message and Time_Exceeded properties can be populated. ICMPv4ErrorMessageContentType Class The ICMPv4ErrorMessageContentType specifies properties common to all types of ICMPv4 error messages. The property table of the ICMPv4ErrorMessageContentType class is given in Table 354. . Properties of the ICMPv4ErrorMessageContentType class Name Type Multiplicity Description IP_Header IPv4HeaderType 0..1 The IP_Header property specifies the IP header from the original datagram. First_Eight_Bytes cyboxCommon: HexBinaryObjectPropertyType 0..1 The First_Eight_Bytes property specifies the first 8 bytes of the original datagram's data. ICMPv4DestinationUnreachableType Class The ICMPv4DestinationUnreachableType class specifies the Destination Unreachable error message; ICMP class=3. The UML diagram corresponding to the ICMPv4DestinationUnreachableType class is shown in Figure 39.
Figure . UML diagram for ICMPv4DestinationUnreachableType class The property table of the ICMPv4DestinationUnreachableType class is given in Table 355. Table . Properties of the ICMPv4DestinationUnreachableType class Name Type Multiplicity Description Has_Choice ICMPv4DestinationUnreachableChoiceType 0..1 The Has_Choice property is associated with the class ICMPv4DestinationUnreachableChoiceType. It indicates that there is a choice among the properties of ICMPv4DestinationUnreachableChoiceType. Only one of the properties of ICMPv4DestinationUnreachableChoiceType class can be populated at any time. See Section 1.2.3 for more detail. The property table of the ICMPv4DestinationUnreachableChoiceType class is given in Table 356. Table . Properties of the ICMPv4DestinationUnreachableChoiceType class Name Type Multiplicity Description Destination_Network_Unreachable basicDataTypes:Boolean 0..1 The Destination_Network_Unreachable property specifies whether the subtype of the message is “destination network unreachable” (code=0). Only one of the properties of ICMPv4DestinationUnreachableChoiceType class can be populated.
Destination_Host_Unreachable basicDataTypes:Boolean 0..1 The Destination_Host_Unreachable property specifies whether the subtype of the message is “destination host unreachable” (code=1). Only one of the properties of ICMPv4DestinationUnreachableChoiceType can be populated. Destination_Protocol_Unreachable basicDataTypes:Boolean 0..1 The Destination_Protocol_Unreachable property specifies whether the subtype of the message is “destination protocol unreachable” (code=2). Only one of the properties of ICMPv4DestinationUnreachableChoiceType can be populated. Destination_Port_Unreachable basicDataTypes:Boolean 0..1 The Destination_Port_Unreachable property specifies whether the subtype of the message is “destination port unreachable” (code=3). Only one of the properties of ICMPv4DestinationUnreachableChoiceType class can be populated. Fragmentation_Required FragmentationRequiredType 0..1 The Fragmentation_Required property specifies whether the subtype of the message is “fragmentation required” (code=4). This property has an additional field (Next-Hop MTU), as well as a boolean value indicating this subtype. Only one of the properties of ICMPv4DestinationUnreachableChoiceType class can be populated.
Name Type Multiplicity Description Fragmentation_Required basicDataTypes:Boolean 0..1 The Fragmentation_Required property specifies whether the subtype of the destination unreachable ICMP message is "fragmentation required". Next_Hop_MTU cyboxCommon: HexBinaryObjectPropertyType 0..1 The Next_Hop_MTU property contains the MTU of the network when a code 4 error (fragmentation required) occurs. ICMPv4SourceQuenchType Class The ICMPv4SourceQuenchType class specifies the Source Quench (congestion control) error message; ICMP class=4. The property table of the ICMPv4SourceQuenchType class is given in Table 358. Table . Properties of the ICMPv4SourceQuenchType class Name Type Multiplicity Description Source_Quench basicDataTypes:Boolean 0..1 The Source_Quench property specifies whether the subtype of the message is a source quench (code=0). ICMPv4RedirectMessageType Class The ICMPv4RedirectMessageType class specifies the Redirect Message error message; ICMP class=5. The UML diagram corresponding to the ICMPv4RedirectMessageType class is shown in Figure 38. The property table of the ICMPv4RedirectMessageType class is given in Table 359. Table . Properties of the ICMPv4RedirectMessageType class Name Type Multiplicity Description
Only one of the Network_Redirect, Host_Redirect, ToS_Network_Redirect and ToS_Host_Redirect properties can be populated. ToS_Network_Redirect basicDataTypes: Boolean 0..1 The ToS_Network_Redirect property specifies whether the subtype of the message is a redirect datagram for the TOS and network (code=2). Only one of the Network_Redirect, Host_Redirect, ToS_Network_Redirect and ToS_Host_Redirect properties can be populated. ToS_Host_Redirect basicDataTypes: Boolean 0..1 The ToS_Host_Redirect property specifies whether the subtype of the message is a redirect datagram for the TOS and host (code=3). Only one of the Network_Redirect, Host_Redirect, ToS_Network_Redirect and ToS_Host_Redirect properties can be populated. ICMPv4TimeExceededType Class The ICMPv4TimeExceededType class specifies the Time Exceeded error message; ICMP class=11. In CybOX 2.1.1, the properties, TTL_Exceeded_In_Transit and Frag_Reassembly_Time_Exceeded are mutually exclusive, i.e., only one property can be populated. This restriction is based on that there are two different types of time exceeded messages. In future releases, it will probably be replaced with one property and a corresponding enumeration. The property table of the ICMPv4TimeExceededType class is given in Table 361. Table . Properties of the ICMPv4TimeExceededType class Name Type Multiplicity Description
midnight UT, then any time can be inserted in a timestamp provided the high order bit of the timestamp is also set to indicate this non-standard value. Transmit_Timestamp cyboxCommon: UnsignedIntegerObjectPropertyType 0..1 The Transmit_Timestamp property specifies the timestamp of the time the echoer last touched the message on sending it. If the time is not available in milliseconds or cannot be provided with respect to midnight UT, then any time can be inserted in a timestamp provided the high bit of the timestamp is also set to indicate this non-standard value. ICMPv4AddressMaskRequestType The ICMPv4AddressMaskRequestType specifies the address mask request informational message; ICMP class=17. The property table of the ICMPv4AddressMaskRequestType class is given in Table 369. Table . Properties of the ICMPv4AddressMaskRequestType class Name Type Multiplicity Description Address_Mask_Request basicDataTypes:Boolean 0..1 The Address_Mask_Request property specifies whether the subtype of the message is an address mask request message (code=17). Address_Mask AddressObj: AddressObjectType 0..1 The Address_Mask property specifies the address mask. It can be set to zero (as opposed to an address mask message, in which case it should be set to the subnet mask). ICMPv4AddressMaskReplyType The ICMPv4AddressMaskReplyType class specifies the address mask informational message; ICMP class=18. The property table of the ICMPv4AddressMaskReplyType class is given in Table 370.
Only one of the Destination_Unreachable, Packet_Too_Big, Time_Exceeded and Parameter_Problem properties can be populated. Packet_Too_Big ICMPv6PacketTooBigType 0..1 The Packet_Too_Big property specifies a packet too big message. It must be sent by a router in response to a packet that it cannot forward because the packet is larger than the MTU of the outgoing link. Only one of the Destination_Unreachable, Packet_Too_Big, Time_Exceeded and Parameter_Problem properties can be populated. Time_Exceeded ICMPv6TimeExceededType 0..1 The Time_Exceeded property specifies a time exceeded message. It is sent if either the hop is exceeded (hop limit = 0) or if fragment reassembly has timed out. Only one of the Destination_Unreachable, Packet_Too_Big, Time_Exceeded and Parameter_Problem properties can be populated. Parameter_Problem ICMPv6ParameterProblemType 0..1 The Parameter_Problem property specifies a parameter problem message. If an IPv6 node processing a packet finds a problem with a property in the IPv6 header or extension headers and it cannot complete processing the packet, it should send an ICMPv6 Parameter Problem message to the packet's source. Only one of the Destination_Unreachable, Packet_Too_Big, Time_Exceeded and Parameter_Problem properties can be populated.
Has_Choice ICMPv6TimeExceededChoiceType 0..1 The Has_Choice property is associated with the class ICMPv6TimeExceededChoiceType. It indicates that there is a choice between the Hop_Limit_Exceeded property or the Fragment_Reassem_Time_Exceeded property. Only one of the properties of ICMPv6TimeExceededChoiceType class can be populated at any time. See Section 1.2.3 for more detail. The ICMPv6TimeExceededChoiceType class is the type of the Has_Choice property. In the UML model, this class is associated with the <<choice>> UML stereotype, which specifies that only one of the available properties of the ICMPv6TimeExceededChoiceType class can be populated at any time. The property table of the ICMPv6TimeExceededChoiceType class is given in Table 381. Table . Properties of the ICMPv6TimeExceededChoiceType class Name Type Multiplicity Description Hop_Limit_Exceeded basicDataTypes: Boolean 0..1 The Hop_Limit_Exceeded property specifies whether the hop limit was exceeded in transit (ICMP v6 code=0). Only one of the Hop_Limit_Exceeded and Fragment_Reassem_Time_Exceeded properties can be populated. Fragment_Reassem_Time_Exceeded basicDataTypes :Boolean 0..1 The Fragment_Reassem_Time_Exceeded property specifies whether the fragment reassembly time was exceeded (ICMP v6 code=1). Only one of the Hop_Limit_Exceeded and Fragment_Reassem_Time_Exceeded properties can be populated.
ICMPv6ParameterProblemType Class The ICMPv6ParameterProblemType class specifies a parameter problem error message; ICMP v6 class=4. The UML diagram corresponding to the ICMPv6ParameterProblemType class is shown in Figure 314. Figure . UML diagram of the ICMPv6ParameterProblemType class The property table of the ICMPv6ParameterProblemType class is given in Table 382. Table . Properties of the ICMPv6ParameterProblemType class Name Type Multiplicity Description Pointer cyboxCommon: HexBinaryObjectPropertyType 0..1 The Pointer property specifies the octet offset within invoking packet where error was detected. Erroneous_Header_Field basicDataTypes:Boolean 0..1 The Erroneous_Header_Field property indicates whether an erroneous header field was encountered (ICMP v6 code=0). Only one of the Erroneous_Header_Field, Unrecognized_Next_Header_Type and Unrecognized_IPv6_Option properties can be populated. Unrecognized_Next_ Header_Type basicDataTypes:Boolean 0..1 The Unrecognized_Next_Header_Type property indicates whether an unrecognized next header type was encountered (ICMP v6 code=1). Only one of the Erroneous_Header_Field, Unrecognized_Next_Header_Type and Unrecognized_IPv6_Option properties can be populated.
Name Type Multiplicity Description Identifier cyboxCommon: HexBinaryObjectPropertyType 0..1 The Identifier property specifies a 16-bit identifier, is combined with the sequence number, and is called the "quench" for echo reply and echo request. Sequence_Number cyboxCommon: HexBinaryObjectPropertyType 0..1 The Sequence_Number property specifies a 16-bit sequence number. The identifier and sequence number can be used by the client to match the reply with the request that caused the reply. ICMPv6EchoRequestType The ICMPv6EchoRequestType class specifies an echo request informational ICMP v6 message; class=128. The property of the ICMPv6EchoRequestType class is given in Table 386. Table . Properties of the ICMPv6EchoRequestType class Name Type Multiplicity Description Echo_Request basicDataTypes:Boolean 0..1 The Echo_Request property specifies whether the subtype of the message is an echo request message (code=128). Data cyboxCommon: HexBinaryObjectPropertyType 0..1 The Data property specifies zero or more octets of arbitrary data. ICMPv6EchoReplyType Echo informational ICMP v6 message; class=129. The property of the ICMPv6EchoReplyType class is given in Table 387. . Properties of the ICMPv6EchoReplyType class
Name Type Multiplicity Description Echo_Reply basicDataTypes:Boolean 0..1 The Echo_Reply property specifies whether the subtype of the message is an echo reply message (code=129). Data cyboxCommon: HexBinaryObjectPropertyType 0..1 The Data property specifies the data resulting from the invoking echo request message. TransportLayerType Class The TransportLayerType specifies the properties of the UDP and TCP protocol. Other protocols will be defined as necessary. The UML diagram corresponding to the TransportLayerType class is shown in Figure 31. The property table of the TransportLayerType class is given in Table 388. Table . Properties of the TransportLayerType class Name Type Multiplicity Description Has_Choice TransportLayerChoiceType 0..1 The Has_Choice property is associated with the TransportLayerChoiceType. It indicates that there is a choice between the TCP and UDP properties. Only one of the properties of TransportLayerChoiceType class can be populated at any time. See Section 1.2.3 for more detail. The TransportLayerChoiceType class is the type of the Has_Choice property. In the UML model, this class is associated with the <<choice>> UML stereotype, which specifies that only one of the available properties of the TransportLayerChoiceType class can be populated at any time. The property table of the TransportLayerChoiceType class is given in Table 389. Table . Properties of the TransportLayerChoiceType class
Name Type Multiplicity Description TCP TCPType 0..1 The TCP property specifies a TCP packet. TCP provides reliable, ordered delivery of a stream of from a program on one computer to another program on another computer. Only one of the TCP and UDP properties can be populated. UDP UDPType 0..1 The UDP property specifies a UDP packet. UDP uses a simple transmission model without implicit handshaking dialogues for providing reliability, ordering, or data integrity. Thus, UDP provides an unreliable service and datagrams may arrive out of order, appear duplicated, or go missing without notice. Only one of the TCP and UDP properties can be populated. TCPType Class The TCPType class specifies a TCP packet. The TCP protocol provides reliable, ordered delivery of a stream of bytes from a program on one computer to another program on another computer. See for more information. The UML diagram corresponding to the TCPType class is shown in Figure 316. Figure . UML diagram of the TCPType class The property of the TCPType class is given in Table 390. . Properties of the TCPType class Name Type Multiplicity Description TCP_Header TCPHeaderType 0..1 The TCP_Header property specifies the 10 mandatory properties and an optional extension property.
. Properties of the UDPType class Name Type Multiplicity Description UDP_Header UDPHeaderType 0..1 The UDP_Header properties consists of four properties. Data cyboxCommon:DataSegmentType 0..1 The Data property specifies the data payload of the UDP packet. UDPHeaderType Class The UDP header class defines the four fields in the UDP header. The property of the UDPHeaderType class is given in Table 394. Table . Properties of the UDPHeaderType class Name Type Multiplicity Description SrcPort PortObj:PortObjectType 0..1 The SrcPort property specifies the sender's port. DestPort PortObj:PortObjectType 0..1 The DestPort property specifies the receiver's port. Length cyboxCommon: IntegerObjectPropertyType 0..1 The Length property specifies the length in bytes of the entire datagram (header and data). Checksum cyboxCommon: HexBinaryObjectPropertyType 0..1 The Checksum property specifies the checksum is used for error-checking of the header and data.
nochange(0) Indicates that the packet does not change change(1) Indicates that the packet may change en-route. IPVersionTypeEnum Enumeration The literals of the IPVersionTypeEnum enumeration are given in Table 3103. Table . Literals of the IPVersionTypeEnum enumeration Enumeration Literal Description IPv4(4) Indicates IP Version 4. ST(5) Indicates the IP version designating ST Datagram Mode. IPv6(6) Indicates IP Version 6. TP/IX(7) Indicates the IP version designating TP/IX: The Next Internet. PIP(8) Indicates the IP version designating PIP: The P Internet Protocol. TUBA(9) Indicates the IP version designating TUBA (TCP and UDP with Bigger Addresses, i.e. ). IANAHardwareTypeEnum Enumeration The literals of the IANAHardwareTypeEnum enumeration are given in Table 3104.
Acknowledgments The following individuals have participated in the creation of this specification and are gratefully acknowledged: Aetna David Crawford AIT Austrian Institute of Technology Roman Fiedler Florian Skopik Australia and New Zealand Banking Group (ANZ Bank) Dean Thompson Blue Coat Systems, Inc. Owen Johnson Bret Jordan Century Link Cory Kennedy CIRCL Alexandre Dulaunoy Andras Iklody Raphaël Vinot Citrix Systems Joey Peloquin Dell Will Urbanski Jeff Williams DTCC Dan Brown Gordon Hundley Chris Koutras EMC Robert Griffin Jeff Odom Ravi Sharda Financial Services Information Sharing and Analysis Center (FS-ISAC) David Eilken Ricard Fortinet Inc. Gavin Chow Airbus Group SAS Joerg Eschweiler Marcos Orallo Anomali Ryan Clough Wei Huang Hugh Njemanze Katie Pelusi Aaron Shelmire Jason Trost Bank of America Alexander Foley Center for Internet Security (CIS) Sarah Kelley Point Software Technologies Ron Davidson Cisco Systems Syam Appala Ted Bedwell David McGrew Pavan Reddy Omar Santos Jyoti Verma Cyber Threat Intelligence Network, Inc. (CTIN) Doug DePeppe Jane Ginn Ben Othman DHS Office of Cybersecurity and Communications (CS&C) Richard Struse Marlon Taylor EclecticIQ Marko Dragoljevic Joep Gommers Sergey Polzunov
Kenichi Terashita Fujitsu Limited Neil Edwards Frederick Hirsch Ryusuke Masuoka Daisuke Murabayashi Google Inc. Mark Risher Hitachi, Ltd. Kazuo Noguchi Akihito Sawada Masato Terada iboss, Inc. Paul Martini Individual Jerome Athias Peter Brown Elysa Jones Sanjiv Kalkar Bar Lockwood Terry MacDonald Alex Pinto Intel Corporation Tim Casey Kent Landfield JPMorgan Chase Bank, N.A. Terrence Driscoll David Laurance LookingGlass Allan Thomson Lee Vorthman Mitre Corporation Greg Back Jonathan Baker Sean Barnum Desiree Beck Nicole Gong Jasen Jacobsen Ivan Kirillov Richard Piazza Jon Salwen Rutger Prins Andrei Sîrghi Raymon van der eSentire, Inc. Jacob Gajek FireEye, Inc. Phillip Gorakav Anuj Kumar Shyamal Pandya Paul Patrick Scott Shreve Fox-IT Sarah Brown Georgetown University Eric Burger Hewlett Packard Enterprise (HPE) Tomas Sander IBM Peter Allor Ben-Haim Sandra Hernandez Jason Keirstead John Morris Rusu Ron Williams IID Chris Richardson Integrated Networking Technologies, Inc. Patrick Maroney Johns Hopkins University Applied Physics Laboratory Karin Marr Julie Modlin Mark Moss Pamela Smith Kaiser Permanente Russell Culpepper Beth Pumo Lumeta Corporation Brandon Hoffman MTG Management Consultants, LLC.
Charles Schmidt Emmanuelle Vargas-Gonzalez John Wunder National Council of ISACs (NCI) Scott Algeier Denise Anderson Josh Poster NEC Corporation Takahiro Kakumaru North American Energy Standards Board David Darnell Object Management Group Cory Casanave Palo Alto Networks Vishaal Hariprasad Queralt, Inc. John Tolbert Resilient Systems, Inc. Ted Julian Securonix Igor Baikalov Siemens AG Bernd Grobauer Soltra John Anderson Aishwarya Asok Kumar Peter Ayasse Jeff Beekman Michael Butt Cynthia Camacho Aharon Chernin Mark Clancy Brady Cotton Trey Darley Mark Davidson Paul Dion Daniel Dye Robert Hutto Raymond Keckler Ali Khan Chris Kiehl Cabral National Security Agency Mike Jessica Fitzgerald-McKay New Context Services, Inc. John-Mark Gurney Christian Hunt James Moler Daniel Riedel Andrew Storms James Bryce Clark Robin Cover Chet Ensign Open Identity Exchange Don Thibeau PhishMe Inc. Josh Larkins Raytheon Company-SAS Daniel Wyschogrod Retail Intelligence Sharing Center Brian Engle Semper Fortis Solutions Joseph Splunk Inc. Cedric LeRoux Brian Luger Kathy Wang TELUS Greg Reaume Alan Steer Threat Intelligence Pty Ltd Tyron Miller Andrew van der ThreatConnect, Inc. Wade Baker Cole Iliff Andrew Pendergast Ben Schmoker Spies TruSTAR Technology
Clayton Long Michael Pepin Natalie Suarez David Waters Benjamin Yates Symantec Corp. Curtis Kostrosky The Boeing Company Crystal ThreatQuotient, Inc. Ryan U.S. Bank Mark Brad Butts Brian Fay Mona Magathan Yevgen Sautin US Department of Defense (DoD) James Bohling Eoghan Casey Gary Katz Jeffrey Mates VeriSign Robert Coderre Kyle Maxwell Eric Osterweil Chris Roblee United Kingdom Cabinet Office Iain Adam Cooper Mike McLellan Chris O’Brien James Penman Howard Staple Chris Taylor Laurie Thomson Alastair Treharne Julian Bethany US Department of Homeland Security Evette Maynard-Noel Justin Stekervetz ViaSat, Inc. Lee Chieffalo Wilson Figueroa Andrew May Yaana Technologies, LLC Anthony Rutkowski The authors also like to thank the larger CybOX Community for its input and help in reviewing this document.