back,buffer_overflow,ftp_write,guess_passwd,imap,ipsweep,land,loadmodule,multiho

p,neptune,nmap,normal,perl,phf,pod,portsweep,rootkit,satan,smurf,spy,teardrop,wa
rezclient,warezmaster.
duration: continuous. 0
protocol_type: symbolic.
service: symbolic.
flag: symbolic.
src_bytes: continuous.
dst_bytes: continuous.
land: symbolic.
wrong_fragment: continuous.
urgent: continuous.
hot: continuous.
num_failed_logins: continuous.
logged_in: symbolic. 12
num_compromised: continuous. 94
root_shell: continuous. 95
su_attempted: continuous. 96
num_root: continuous. 97
num_file_creations: continuous. 98
num_shells: continuous. 99
num_access_files: continuous. 100
num_outbound_cmds: continuous. 101
is_host_login: symbolic. 102
is_guest_login: symbolic. 103
count: continuous. 23
srv_count: continuous. 24
serror_rate: continuous. 106
srv_serror_rate: continuous. 107
rerror_rate: continuous. 108
srv_rerror_rate: continuous. 109
same_srv_rate: continuous. 110
diff_srv_rate: continuous. 111
srv_diff_host_rate: continuous. 31
dst_host_count: continuous. 32
dst_host_srv_count: continuous. 33
dst_host_same_srv_rate: continuous. 34
dst_host_diff_srv_rate: continuous. 35
dst_host_same_src_port_rate: continuous. 117
dst_host_srv_diff_host_rate: continuous.37
dst_host_serror_rate: continuous.119
dst_host_srv_serror_rate: continuous.120
dst_host_rerror_rate: continuous.121
dst_host_srv_rerror_rate: continuous. 122