 |
Length field of ZAPHP means that payload size is 74bytes.
Packet Offset field means that Full Packet filed begins at the 44th byte. Also, it can be checked that raw data matched with rule begins at the 42th byte and ends at the 43th byte by Start Byte field and End Byte field.
Lastly, ZAPHP includes raw data matched with rule and full packet data.
Packet Highlight System displays full packet by highlighting data that matches with rule.
Users can check information about rule, zero-day packet and raw data that matches with rule though output of Packet Highlight System.
In a flow-based PCA, the values displayed on the output are transferred in the form of Json and displayed from the web UI |
IEEE/ICACT20210179 Slide.15
[Big Slide]