Re: [IDMEF][Issue 5] duplicate information related to protocol information.

On Sun, 11 Jan 2004, David A. Curry wrote:

> I think Layer 2 is outside the scope of what IDMEF was originally thinking
> about.  

If so, then the draft should state it clearly. 

> That doesn't mean it couldn't be added (although I'm loathe to do so
> at this late date),

I understand. :-)

> or that Prelude (I don't know what that is, but I assume it's an IDS
> project of some sort)

Correct. http://www.prelude-ids.org/

> couldn't define some type of an extension for it.

We already do, by putting the layer 2 information into Additional Data
objects. This way has turned out to be impractical, paticularly because of
problems related to constructing relevant database queries. So we're
looking at the other possible solutions. 

// Krzysztof Zaraska * kzaraska (at) student.uci.agh.edu.pl
// http://mops.uci.agh.edu.pl/~kzaraska/ * http://www.prelude-ids.org/
// A dream will always triumph over reality, once it is given the chance.
//		-- Stanislaw Lem