<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE lire:report-spec PUBLIC
  "-//LogReport.ORG//DTD Lire Report Specification Markup Language V2.0//EN"
  "http://www.logreport.org/LRSML/2.0/lrsml.dtd">
<lire:report-spec xmlns:lire="http://www.logreport.org/LRSML/"
 superservice="firewall" id="top-pkt-by-dst-by-port">

<!-- Copyright (C) 2003 Tilburg University http://www.uvt.nl/

This file is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This file is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
General Public License for more details.

A copy of the GNU General Public License is available online at
http://www.gnu.org/copyleft/gpl.html,.
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111,
USA.

-->

 <lire:title>Top Packets by Destination by Port Firewall Report</lire:title>
 <lire:description>
  <para>This report will show for each destination IP the ports
   that received the most packets.
  </para>
 </lire:description>

 <lire:param-spec>
  <lire:param name="dst_to_show" type="int" default="15">
   <lire:description>
    <para>This parameter controls the number of destination IPs
     to display in the report.
    </para>
   </lire:description>
  </lire:param>
  <lire:param name="ports_to_show" type="int" default="20">
   <lire:description>
    <para>This parameter controls the number of destination ports
     that will be displayed for each destination.
    </para>
   </lire:description>
  </lire:param>
 </lire:param-spec>

 <lire:display-spec>
  <lire:title>Top Destinations by Port, Top $dst_to_show IPs, Top 
   $ports_to_show destination ports</lire:title>
 </lire:display-spec>

 <lire:report-calc-spec>
  <lire:group sort="-pkt_count" limit="$dst_to_show">
   <lire:field name="to_ip"/>

   <lire:group sort="-pkt_count" limit="$ports_to_show">
    <lire:field name="protocol"/>
    <lire:field name="to_port"/>

    <lire:sum name="pkt_count" field="count" label="Packets"/>
    <lire:sum name="pkt_ratio" field="count" ratio="table" label="% Total"/>
    <lire:sum name="pkt_group_ratio" field="count" ratio="group" label="% Dest"/>
   </lire:group>
  </lire:group>
 </lire:report-calc-spec>

</lire:report-spec>

