<?xml version="1.0" encoding="utf-8"?>
<ProtoSpecTable Version="2.0.0.10">
	<ColorTable>
		<ColorDef Name="color_none" RGB="0x000000"/>
		<ColorDef Name="color_1" RGB="0x000055"/>
		<ColorDef Name="color_2" RGB="0x003f55"/>
		<ColorDef Name="color_3" RGB="0x843d00"/>
		<ColorDef Name="color_4" RGB="0x007f00"/>
		<ColorDef Name="color_5" RGB="0x557f00"/>
		<ColorDef Name="color_6" RGB="0x551f2a"/>
		<ColorDef Name="color_7" RGB="0xaa5f2a"/>
		<ColorDef Name="color_8" RGB="0x550055"/>
		<ColorDef Name="color_9" RGB="0x003f7f"/>
		<ColorDef Name="color_10" RGB="0x009f7f"/>
		<ColorDef Name="color_11" RGB="0x008000"/>
		<ColorDef Name="color_12" RGB="0x000080"/>
		<ColorDef Name="color_13" RGB="0x808000"/>
		<ColorDef Name="color_14" RGB="0x800000"/>
		<ColorDef Name="color_15" RGB="0x800080"/>
		<ColorDef Name="color_16" RGB="0x55007f"/>
		<ColorDef Name="color_17" RGB="0x007fd4"/>
		<ColorDef Name="color_18" RGB="0x00bf00"/>
		<ColorDef Name="color_19" RGB="0xaabf00"/>
		<ColorDef Name="color_20" RGB="0xaa7f00"/>
		<ColorDef Name="color_21" RGB="0xaa0055"/>
		<ColorDef Name="color_22" RGB="0xaa00d4"/>
		<ColorDef Name="color_23" RGB="0x0000d4"/>
	</ColorTable>
	<PSpec Name="IEEE 802.3">
		<PSpecID>1</PSpecID>
		<LName>IEEE 802.3 CSMA/CD Ethernet</LName>
		<SName>802.3</SName>
		<Desc>802.3 is a comprehensive standard for Local Area Networks employing the Carrier Sense Multiple Access with Collision Detection (CSMA/CD) access method. Under the International Standards Organization (ISO) the 10 megabits per second transmission speed is specified by ISO/DIS 8802/3. The definition of Ethernet under 802.3 supersedes the previous Ethernet standard known as Ethernet Type 2. In terms of data bytes in the protocol stack, 802.3 uses bytes 13 and 14 as a length field, whereas the earlier standard used these bytes as a protocol definition field.</Desc>
		<Color>color_1</Color>
		<CondExp><![CDATA[ MLD16[12] <= 1500 ]]></CondExp>
		<NextLayer>
			<Exp><![CDATA[    14    ]]></Exp>
		</NextLayer>
		<Link Name="802.2 LLC"/>
	</PSpec>
	<PSpec Name="Error">
		<PSpecID>6</PSpecID>
		<LName>Error</LName>
		<SName>Error</SName>
		<Desc>Physical layer error.</Desc>
		<Color>color_2</Color>
		<PSpec Name="CRC">
			<PSpecID>50</PSpecID>
			<LName>CRC Error</LName>
			<SName>CRC Error</SName>
			<Desc>At the end of a packet, four bytes are transmitted (the Frame Check Sequence or FCS) which force the checksum to a known constant. If the receiving end does not compute the same constant after receiving these four bytes, the packet is deemed to have a CRC error. A CRC error most often occurs when a packet is abruptly terminated or the first part of the packet of the packet is lost. A more uncommon occurrence of a CRC error is faulty hardware or software which does not compute the CRC correctly.</Desc>
			<Color>color_23</Color>
		</PSpec>
		<PSpec Name="Frame">
			<PSpecID>51</PSpecID>
			<LName>Frame Alignment Error</LName>
			<SName>Frame Error</SName>
			<Desc>It is highly improbable that a frame error would occur without a CRC error in the same packet unless the receiving hardware&apos;s checksum mechanism or frame error detection circuitry is faulty.</Desc>
			<Color>color_17</Color>
		</PSpec>
		<PSpec Name="CRC &amp; Frame">
			<PSpecID>52</PSpecID>
			<LName>CRC &amp; Frame Alignment Error</LName>
			<SName>CRC &amp; Frame Error</SName>
			<Desc>Each byte is transmitted onto a bit at a time and the receiver hardware collects the bits back into 8-bit bytes. A frame error is detected when the number of bits falls out of sequence and does not collect evenly into a number of 8-bit bytes. When this happens, a CRC error also normally occurs since the computed value of the bytes also will differ from what was transmitted. It is not that unusual to see occasional frame and CRC errors as part of normal traffic. When there are collisions it is possible that packets which are in the process of being transmitted will be disrupted. Once such a disruption occurs, because the bits may shift between consecutive bytes, no byte in the packet can be considered to be possibly valid.</Desc>
			<Color>color_16</Color>
		</PSpec>
		<PSpec Name="Oversize">
			<PSpecID>53</PSpecID>
			<LName>Oversize Error</LName>
			<SName>Oversize Error</SName>
			<Desc>By definition, Ethernet packets must be between 64 and 1518 bytes in length including 14 bytes of Ethernet packet header and 4 bytes of frame check sequence (FCS). An oversize packet is a packet which is greater than 1518 bytes long, but is otherwise well-formed. Oversize packets are usually caused by bad software implementations.</Desc>
			<Color>color_13</Color>
		</PSpec>
		<PSpec Name="CRC &amp; Oversize">
			<PSpecID>54</PSpecID>
			<LName>CRC &amp; Oversize Error</LName>
			<SName>CRC &amp; Oversize Error</SName>
			<Desc>By definition, Ethernet packets must be between 64 and 1518 bytes in length including 14 bytes of Ethernet packet header and 4 bytes of frame check sequence (FCS). An oversize packet is a packet which is greater than 1518 bytes long. When such a packet also has a CRC error, it is a possible indication that the packet was not transmitted as an oversize packet, but may have run together with another packet. On busy networks, an occasional packet with these two errors is not that unusual.</Desc>
			<Color>color_14</Color>
		</PSpec>
		<PSpec Name="Frame &amp; Oversize">
			<PSpecID>55</PSpecID>
			<LName>Frame Alignment &amp; Oversize Error</LName>
			<SName>Frame &amp; Oversize Error</SName>
			<Desc>An oversize packet is a packet which is greater than 1518 bytes long. When such a packet also has a frame error, but no CRC error, it is most likely that there is a hardware or software error in the Ethernet hardware.</Desc>
			<Color>color_15</Color>
		</PSpec>
		<PSpec Name="CRC &amp; Frame &amp; Oversize">
			<PSpecID>56</PSpecID>
			<LName>CRC &amp; Frame Alignment &amp; Oversize Error</LName>
			<SName>CRC &amp; Frame &amp; Oversize Error</SName>
			<Desc>By definition, Ethernet packets must be between 64 and 1518 bytes in length including 14 bytes of Ethernet packet header and 4 bytes of frame check sequence (FCS). An oversize packet is a packet which is greater than 1518 bytes long. When such a packet also has a CRC error, it is a possible indication that the packet was not transmitted as an oversize packet, but may have run together with another packet. When such a packet also has a frame error, it is almost certainly a sign that multiple packets have interfered with each other. On busy networks, an occasional packet with these three errors is not that unusual.</Desc>
		</PSpec>
		<PSpec Name="Runt">
			<PSpecID>57</PSpecID>
			<LName>Runt Error</LName>
			<SName>Runt Error</SName>
			<Desc>By definition, Ethernet packets must be between 64 and 1518 bytes in length including 14 bytes of Ethernet packet header and 4 bytes of frame check sequence (FCS). A runt packet is a packet which is shorter than 64 bytes, but is otherwise well-formed. These errors are usually caused by bad software implementations.</Desc>
			<Color>color_9</Color>
		</PSpec>
		<PSpec Name="CRC &amp; Runt">
			<PSpecID>58</PSpecID>
			<LName>CRC &amp; Runt Error</LName>
			<SName>CRC &amp; Runt Error</SName>
			<Desc>By definition, Ethernet packets must be between 64 and 1518 bytes in length including 14 bytes of Ethernet packet header and 4 bytes of frame check sequence (FCS). A runt packet is a packet which is shorter than 64 bytes long. When such a packet also has a CRC error, it is a possible indication that the packet was not transmitted as a runt packet, but may have run been truncated prematurely or the first part of the packet may have been lost.</Desc>
			<Color>color_18</Color>
		</PSpec>
		<PSpec Name="Frame &amp; Runt">
			<PSpecID>59</PSpecID>
			<LName>Frame Alignment &amp; Runt Error</LName>
			<SName>Frame &amp; Runt Error</SName>
			<Desc>By definition, Ethernet packets must be between 64 and 1518 bytes in length including 14 bytes of Ethernet packet header and 4 bytes of frame check sequence (FCS). A runt packet is a packet which is shorter than 64 bytes long. It is highly improbable that such a packet would not also have a CRC error, hence is an almost certain indication of a software problem or a failure of the CRC hardware.</Desc>
			<Color>color_19</Color>
		</PSpec>
		<PSpec Name="CRC &amp; Frame &amp; Runt">
			<PSpecID>60</PSpecID>
			<LName>CRC &amp; Frame Alignment &amp; Runt Error</LName>
			<SName>CRC &amp; Frame &amp; Runt Error</SName>
			<Desc>By definition, Ethernet packets must be between 64 and 1518 bytes in length including 14 bytes of Ethernet packet header and 4 bytes of frame check sequence (FCS). A runt packet is a packet which is shorter than 64 bytes long. When such a packet also has a CRC error, it is a possible indication that the packet was not transmitted as a runt packet, but may have been truncated prematurely or the first part of the packet may have been lost. When such a packet also has a frame error, it is almost certainly a sign that the packet was impacted by another packet. On busy networks, an occasional packet with these three errors is not that unusual.</Desc>
			<Color>color_20</Color>
		</PSpec>
	</PSpec>
	<PSpec Name="IEEE 802.11">
		<PSpecID>5</PSpecID>
		<LName>IEEE 802.11 CSMA/CA WLAN</LName>
		<SName>802.11</SName>
		<Desc>802.11 is a comprehensive standard for Wireless Local Area Networks employing the Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) access method.</Desc>
		<Color>color_12</Color>
		<Definitions>
			<Define>
				<Name>PacketBits</Name>
				<Value><![CDATA[(MLD8[0] & 0x0c)]]></Value>
			</Define>
			<Define>
				<Name>FragmentNumber</Name>
				<Value><![CDATA[(PLD8[22] & 0x0f)]]></Value>
			</Define>
		</Definitions>
		<PSpec Name="802.11 Control">
			<PSpecID>200</PSpecID>
			<LName>802.11 Control</LName>
			<SName>802.11 Control</SName>
			<Desc>There are six control frame subtypes in 802.11: request to send (RTS), clear to send (CTS), acknowledge (ACK), power save poll (PS-Poll), contention-free end (CF-End), and contention-free end plus ACK (CF-End+CF-Ack).</Desc>
			<Color>color_14</Color>
			<CondExp><![CDATA[PacketBits == 0x04]]></CondExp>
			<Definitions>
				<Define>
					<Name>ControlBits</Name>
					<Value><![CDATA[(MLD8[0] & 0xfc)]]></Value>
				</Define>
			</Definitions>
			<PSpec Name="PowerSave-Poll">
				<PSpecID>210</PSpecID>
				<LName>802.11 Control Power-Save Poll</LName>
				<SName>802.11 PS-Poll</SName>
				<Desc>Stations in power save mode awaken periodically to listen to selected Beacons. If they hear that data is waiting for them, they will awake more fully and send a PS-Poll packet to the access point (BSS) to request the transmission of this waiting data. The Duration/ID field contains the Association ID (AID) for the station sending the packet.</Desc>
				<Color>color_5</Color>
				<CondExp><![CDATA[ControlBits == 0xa4]]></CondExp>
			</PSpec>
			<PSpec Name="Request to Send">
				<PSpecID>211</PSpecID>
				<LName>802.11 Control Request to Send</LName>
				<SName>802.11 RTS</SName>
				<Desc>Request To Send packets help coordinate access to airwaves.</Desc>
				<Color>color_7</Color>
				<CondExp><![CDATA[ControlBits == 0xb4]]></CondExp>
			</PSpec>
			<PSpec Name="Clear to Send">
				<PSpecID>212</PSpecID>
				<LName>802.11 Control Clear to Send</LName>
				<SName>802.11 CTS</SName>
				<Desc>A Clear To Send packet is sent in response to a Request To Send. Helps coordinates access to airwaves.</Desc>
				<Color>color_9</Color>
				<CondExp><![CDATA[ControlBits == 0xc4]]></CondExp>
			</PSpec>
			<PSpec Name="Acknowledgment">
				<PSpecID>213</PSpecID>
				<LName>802.11 Control Acknowledgment</LName>
				<SName>802.11 Ack</SName>
				<Desc>Acknowledges receipt of transmitted data.</Desc>
				<Color>color_17</Color>
				<CondExp><![CDATA[ControlBits == 0xd4]]></CondExp>
			</PSpec>
			<PSpec Name="Contention-Free End">
				<PSpecID>214</PSpecID>
				<LName>802.11 Control Contention-Free End</LName>
				<SName>802.11 CFE</SName>
				<Desc>Signals the end of Contention Free period.</Desc>
				<Color>color_11</Color>
				<CondExp><![CDATA[ControlBits == 0xe4]]></CondExp>
			</PSpec>
			<PSpec Name="CF-End+CF-Ack">
				<PSpecID>215</PSpecID>
				<LName>802.11 Control CF-End+CF-Ack</LName>
				<SName>802.11 CFE+CFA</SName>
				<Desc>Signals the end of the Contention Free period and Acknowledges the receipt of transmitted data in a single message.</Desc>
				<Color>color_2</Color>
				<CondExp><![CDATA[ControlBits == 0xf4]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="802.11 Management">
			<PSpecID>201</PSpecID>
			<LName>802.11 Management</LName>
			<SName>802.11 Management</SName>
			<Desc>There are 11 distinct management frame types. All management frames include fields: frame control duration address 1, 2, and 3, sequence control, frame body and frame check sequence. The frame body carries information in both fixed fields and in variable length information elements. Management frames in 802.11: beacon, probe request and response, authentication, deauthentication, association request and response, reassociation request and response, disassociation, and announcement traffic indication message.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[PacketBits == 0x00]]></CondExp>
			<Definitions>
				<Define>
					<Name>ManagementBits</Name>
					<Value><![CDATA[(MLD8[0] & 0xfc)]]></Value>
				</Define>
			</Definitions>
			<PSpec Name="Association Req">
				<PSpecID>220</PSpecID>
				<LName>802.11 Management Association Request</LName>
				<SName>802.11 Assoc Req</SName>
				<Desc>An Association Request is sent to an access point (in a BSS or ESS) or to any other peer (in an IBSS or ad hoc network). The sender must already be authenticated in order to gain a successful association.</Desc>
				<Color>color_20</Color>
				<CondExp><![CDATA[ManagementBits == 0x00]]></CondExp>
			</PSpec>
			<PSpec Name="Association Rsp">
				<PSpecID>221</PSpecID>
				<LName>802.11 Management Association Response</LName>
				<SName>802.11 Assoc Rsp</SName>
				<Desc>An Association Response is sent from an access point (in a BSS or ESS) or from any other peer (in an IBSS or ad hoc network) in response to an Association Request packet. If the request is successful, the response will include the Association ID of the requester.</Desc>
				<Color>color_11</Color>
				<CondExp><![CDATA[ManagementBits == 0x10]]></CondExp>
			</PSpec>
			<PSpec Name="Reassociation Req">
				<PSpecID>222</PSpecID>
				<LName>802.11 Management Reassociation Request</LName>
				<SName>802.11 Reassoc Req</SName>
				<Desc>Similar to an Association Request, but it includes information about the current association at the same time as it requests a new association (either with the original Station after some lapse of time, or with a new station upon moving from one BSS to another). This packet is sent to an access point (in a BSS or ESS) or to any other peer (in an IBSS or ad hoc network). The sender must already be authenticated in order to gain a successful association.</Desc>
				<Color>color_8</Color>
				<CondExp><![CDATA[ManagementBits == 0x20]]></CondExp>
			</PSpec>
			<PSpec Name="Reassociation Rsp">
				<PSpecID>223</PSpecID>
				<LName>802.11 Management Reassociation Response</LName>
				<SName>802.11 Reassoc Rsp</SName>
				<Desc>Similar to an Association Response, but in response to a Reassociation Request. This packet is sent from an access point (in a BSS or ESS) or from any other peer (in an IBSS or ad hoc network) in response to a Reassociation Request packet. If the request is successful, the response will include the Association ID of the requester.</Desc>
				<Color>color_21</Color>
				<CondExp><![CDATA[ManagementBits == 0x30]]></CondExp>
			</PSpec>
			<PSpec Name="Probe Req">
				<PSpecID>224</PSpecID>
				<LName>802.11 Management Probe Request</LName>
				<SName>802.11 Probe Req</SName>
				<Desc>A Probe Request is used to actively seek any, or a particular, access point or BSS.</Desc>
				<Color>color_9</Color>
				<CondExp><![CDATA[ManagementBits == 0x40]]></CondExp>
			</PSpec>
			<PSpec Name="Probe Rsp">
				<PSpecID>225</PSpecID>
				<LName>802.11 Management Probe Response</LName>
				<SName>802.11 Probe Rsp</SName>
				<Desc>A Probe Response is a reply to a Probe Request with station parameters and supported data rates.</Desc>
				<Color>color_12</Color>
				<CondExp><![CDATA[ManagementBits == 0x50]]></CondExp>
			</PSpec>
			<PSpec Name="Beacon">
				<PSpecID>226</PSpecID>
				<LName>802.11 Management Beacon</LName>
				<SName>802.11 Beacon</SName>
				<Desc>Beacon packets are sent by the access point in a BSS (or its equivalent in an IBSS) to announce the beginning of a Contention Free period (CF), during which the right to transmit is conferred by the access point by polling. Beacon management packets carry BSS timestamps to help synchronize member stations with the BSS, and other information to help them locate and choose the BSS with the best signal and availability.</Desc>
				<Color>color_14</Color>
				<CondExp><![CDATA[ManagementBits == 0x80]]></CondExp>
			</PSpec>
			<PSpec Name="ATIM">
				<PSpecID>227</PSpecID>
				<LName>802.11 Management ATIM</LName>
				<SName>802.11 ATIM</SName>
				<Desc>An Announcement Traffic Indication Message packet serves much the same function in an IBSS that the Beacon packet does in an infrastructure (BSS or ESS) topology. The packet sets the synchronization of the group and announces that messages are waiting to be delivered. Stations in Power Save mode wake up periodically to listen for ATIM packets in ad hoc (IBSS) networks, just as they do for Beacon packets in infrastructure (BSS or ESS) networks.</Desc>
				<Color>color_3</Color>
				<CondExp><![CDATA[ManagementBits == 0x90]]></CondExp>
			</PSpec>
			<PSpec Name="Disassociation">
				<PSpecID>228</PSpecID>
				<LName>802.11 Management Disassociation</LName>
				<SName>802.11 Disassoc</SName>
				<Desc>This packet is an announcement breaking an existing association. It is a one-way communication (meaning it does not require or accept a reply), and must be accepted. It can be sent by any associated station or BSS and it takes effect immediately.</Desc>
				<Color>color_22</Color>
				<CondExp><![CDATA[ManagementBits == 0xa0]]></CondExp>
			</PSpec>
			<PSpec Name="Authentication">
				<PSpecID>229</PSpecID>
				<LName>802.11 Management Authentication</LName>
				<SName>802.11 Auth</SName>
				<Desc>Authentication packets are sent back and forth between the station requesting authentication and the station to which it is attempting to assert its authentic identity. The number of packets exchanged depends on the authentication method employed. Information relating to the particular scheme is carried in the body of the Authentication packet.</Desc>
				<Color>color_23</Color>
				<CondExp><![CDATA[ManagementBits == 0xb0]]></CondExp>
			</PSpec>
			<PSpec Name="Deauthentication">
				<PSpecID>230</PSpecID>
				<LName>802.11 Management Deauthentication</LName>
				<SName>802.11 Deauth</SName>
				<Desc>A Deauthentication packet is an announcement stating that the receiver is no longer authenticated. It is a one-way communication from the authenticating station (a BSS or functional equivalent), and must be accepted. It takes effect immediately.</Desc>
				<Color>color_12</Color>
				<CondExp><![CDATA[ManagementBits == 0xc0]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="802.11 Data">
			<PSpecID>202</PSpecID>
			<LName>802.11 Data</LName>
			<SName>802.11 Data</SName>
			<Desc>The simple data frame encapsulates the upper layer protocol packets delivering them from one IEEE 802.11 station to another. It may appear in both the contention period and the contention-free period.</Desc>
			<Color>color_4</Color>
			<CondExp><![CDATA[PacketBits == 0x08]]></CondExp>
			<NextLayer>
				<Exp><![CDATA[     ( ( PLD8[1] & 0x03 ) == 0x03 ) ? 30 : 24    ]]></Exp>
			</NextLayer>
			<Link Name="802.2 LLC" Sort="Last"/>
			<PSpec Name="802.11 Fragment">
				<PSpecID>241</PSpecID>
				<LName>802.11 Data Fragment</LName>
				<SName>802.11 Frag</SName>
				<Desc>802.11 data fragment.</Desc>
				<Color>color_12</Color>
				<CondExp><![CDATA[   FragmentNumber != 0    ]]></CondExp>
			</PSpec>
			<PSpec Name="802.11 WEP Data">
				<PSpecID>240</PSpecID>
				<LName>802.11 WEP Data</LName>
				<SName>802.11 WEP Data</SName>
				<Desc>WEP-encoded 802.11 data.</Desc>
				<Color>color_13</Color>
				<CondExp><![CDATA[(PLD8[1] & 0x40) == 0x40]]></CondExp>
			</PSpec>
		</PSpec>
	</PSpec>
	<PSpec Name="Token Ring">
		<PSpecID>4</PSpecID>
		<LName>IEEE 802.5 Token Ring</LName>
		<SName>Token Ring</SName>
		<Desc>Token Ring was developed by IBM, and standardized by the IEEE as the IEEE 802.5 standard. A Token Ring network can consists of up to 255 nodes, connected in a star topology. Token Ring is a data link (MAC layer) protocol and functions at layers 1 and 2 of the OSI model.</Desc>
		<Color>color_7</Color>
		<NextLayer>
			<Exp><![CDATA[    14    ]]></Exp>
		</NextLayer>
		<Definitions>
			<Define>
				<Name>FrameBits</Name>
				<Value><![CDATA[(PLD8[1] & 0xc0)]]></Value>
			</Define>
			<Define>
				<Name>AccessControl</Name>
				<Value><![CDATA[PLD8[0]]]></Value>
			</Define>
		</Definitions>
		<PSpec Name="MAC">
			<PSpecID>100</PSpecID>
			<LName>Medium Access Control (MAC) Frame</LName>
			<SName>MAC</SName>
			<Desc>Medium Access Control frames are originated, received, and acted upon by ring stations. These frames control the operation of the Token-Ring network and any ring station operations that affect the ring.</Desc>
			<CondExp><![CDATA[FrameBits == 0x00 && (AccessControl & 0x10) == 0x10]]></CondExp>
			<Definitions>
				<Define>
					<Name>MACVector</Name>
					<Value><![CDATA[MLD8[3]]]></Value>
				</Define>
			</Definitions>
			<PSpec Name="Response">
				<PSpecID>102</PSpecID>
				<LName>MAC Response</LName>
				<SName>MAC Response</SName>
				<Desc>This frame is sent from one ring station to another to acknowledge receipt of response MAC frames, or to report a syntax error in, a MAC frame received with a ring station destination class.</Desc>
				<CondExp><![CDATA[MACVector == 0x00]]></CondExp>
			</PSpec>
			<PSpec Name="Beacon">
				<PSpecID>103</PSpecID>
				<LName>MAC Beacon</LName>
				<SName>MAC Beacon</SName>
				<Desc>If a ring station detects the expiration of T(claim_token) during the token-claiming process, then the ring station transmits this frame to all other ring stations on the same ring.</Desc>
				<CondExp><![CDATA[MACVector == 0x02]]></CondExp>
			</PSpec>
			<PSpec Name="Claim Token">
				<PSpecID>104</PSpecID>
				<LName>MAC Claim Token</LName>
				<SName>MAC Claim Token</SName>
				<Desc>This frame is transmitted by a ring station to all other ring stations on the same ring during the token-claiming process.</Desc>
				<CondExp><![CDATA[MACVector == 0x03]]></CondExp>
			</PSpec>
			<PSpec Name="Ring Purge">
				<PSpecID>105</PSpecID>
				<LName>MAC Ring Purge</LName>
				<SName>MAC Ring Purge</SName>
				<Desc>This frame is sent by the active monitor to all other ring stations on the same ring if one of the following conditions occurs: 1) the token-claiming process is completed, or 2) a token error is detected.</Desc>
				<CondExp><![CDATA[MACVector == 0x04]]></CondExp>
			</PSpec>
			<PSpec Name="Active Mon Present">
				<PSpecID>106</PSpecID>
				<LName>MAC Active Monitor Present</LName>
				<SName>MAC Act Mon Pres</SName>
				<Desc>Sent by the active monitor to all other ring stations on the same ring at the completion of the ring purge process or at the expiration of the active monitor&apos;s timer. This frame is used to inform standby monitors of the active monitor&apos;s presence; indicate that the ring is functioning correctly; and initiate neighbor notification.</Desc>
				<CondExp><![CDATA[MACVector == 0x05]]></CondExp>
			</PSpec>
			<PSpec Name="Standby Mon Present">
				<PSpecID>107</PSpecID>
				<LName>MAC Standby Monitor Present</LName>
				<SName>MAC Stby Mon Pres</SName>
				<Desc>This frame is sent by a standby monitor to all ring stations on the same ring when it receives an Active Monitor Present or Standby Monitor Present MAC frame with A = C = 0.</Desc>
				<CondExp><![CDATA[MACVector == 0x06]]></CondExp>
			</PSpec>
			<PSpec Name="Dup Addr Test">
				<PSpecID>108</PSpecID>
				<LName>MAC Duplicate Address Test</LName>
				<SName>MAC Dup Addr Test</SName>
				<Desc>This frame is sent by a ring station addressed to itself to assure that during attachment on other ring station on the same ring has the same individual address, and during self-test the station can receive frames.</Desc>
				<CondExp><![CDATA[MACVector == 0x07]]></CondExp>
			</PSpec>
			<PSpec Name="Lobe Test">
				<PSpecID>109</PSpecID>
				<LName>MAC Lobe Test</LName>
				<SName>MAC Lobe Test</SName>
				<Desc>This frame is sent by a ring station to test the bit error rate in its loop-back path: before the ring stations physical attachment to the ring; and during the beacon self-test process. The destination of this frame is the null address.</Desc>
				<CondExp><![CDATA[MACVector == 0x08]]></CondExp>
			</PSpec>
			<PSpec Name="Transmit Forward">
				<PSpecID>110</PSpecID>
				<LName>MAC Transmit Forward</LName>
				<SName>MAC Xmit Fwd</SName>
				<Desc>This frame is sent by the LAN manager to a ring station to cause the ring station to construct a frame for transmission from the data contained in the information field.</Desc>
				<CondExp><![CDATA[MACVector == 0x09]]></CondExp>
			</PSpec>
			<PSpec Name="Remove Ring Sta">
				<PSpecID>111</PSpecID>
				<LName>MAC Remove Ring Station</LName>
				<SName>MAC Rmve Ring Sta</SName>
				<Desc>This frame is sent by the configuration report server to instruct a ring station to remove itself from the ring.</Desc>
				<CondExp><![CDATA[MACVector == 0x0b]]></CondExp>
			</PSpec>
			<PSpec Name="Change Params">
				<PSpecID>112</PSpecID>
				<LName>MAC Change Parameters</LName>
				<SName>MAC Change Params</SName>
				<Desc>This frame is sent by the configuration report server to a station to set any appropriate ring operational values.</Desc>
				<CondExp><![CDATA[MACVector == 0x0c]]></CondExp>
			</PSpec>
			<PSpec Name="Init Ring Sta">
				<PSpecID>113</PSpecID>
				<LName>MAC Initialize Ring Station</LName>
				<SName>MAC Init Ring Sta</SName>
				<Desc>This frame is sent by the ring parameter server to respond to a ring station&apos;s Request Initialization MAC frame, and to set any appropriate ring operational values.</Desc>
				<CondExp><![CDATA[MACVector == 0x0d]]></CondExp>
			</PSpec>
			<PSpec Name="Req Sta Address">
				<PSpecID>114</PSpecID>
				<LName>MAC Request Station Address</LName>
				<SName>MAC Req Sta Addr</SName>
				<Desc>This frame is sent by the configuration report server to a ring station to request the ring station&apos;s address information.</Desc>
				<CondExp><![CDATA[MACVector == 0x0e]]></CondExp>
			</PSpec>
			<PSpec Name="Req Sta State">
				<PSpecID>115</PSpecID>
				<LName>MAC Request Station State</LName>
				<SName>MAC Req Sta State</SName>
				<Desc>This frame is sent by the configuration report server to a ring station to request the state of the ring station&apos;s adapter.</Desc>
				<CondExp><![CDATA[MACVector == 0x0f]]></CondExp>
			</PSpec>
			<PSpec Name="Req Sta Attach">
				<PSpecID>116</PSpecID>
				<LName>MAC Request Station Attachment</LName>
				<SName>MAC Req Stn Attmnt</SName>
				<Desc>This frame is sent by the configuration report server to a ring station to request information regarding the product in which the ring station resides.</Desc>
				<CondExp><![CDATA[MACVector == 0x10]]></CondExp>
			</PSpec>
			<PSpec Name="Request Init">
				<PSpecID>117</PSpecID>
				<LName>MAC Request Initialization</LName>
				<SName>MAC Reqest Init</SName>
				<Desc>This frame is sent by a ring station to the ring parameter server to inform the latter that the ring station has attached to the ring and will accept modified parameters from either the ring parameter server or the configuration report server.</Desc>
				<CondExp><![CDATA[MACVector == 0x20]]></CondExp>
			</PSpec>
			<PSpec Name="Report Sta Addr">
				<PSpecID>118</PSpecID>
				<LName>MAC Report Station Address</LName>
				<SName>MAC Rpt Sta Addrs</SName>
				<Desc>This frame is sent by a ring station to the configuration report server to respond to the latter&apos;s Request Ring Station Address frame.</Desc>
				<CondExp><![CDATA[MACVector == 0x22]]></CondExp>
			</PSpec>
			<PSpec Name="Report Sta State">
				<PSpecID>119</PSpecID>
				<LName>MAC Report Station State</LName>
				<SName>MAC Rpt Sta State</SName>
				<Desc>This frame is sent by a ring station to the configuration report server to respond to the latter&apos;s Request Ring Station State frame.</Desc>
				<CondExp><![CDATA[MACVector == 0x23]]></CondExp>
			</PSpec>
			<PSpec Name="Report Sta Attach">
				<PSpecID>120</PSpecID>
				<LName>MAC Report Station Attachment</LName>
				<SName>MAC Rpt Sta Attmnt</SName>
				<Desc>This frame is sent by a ring station to the configuration report server to respond to the latter&apos;s Request Ring Station Attachments frame.</Desc>
				<CondExp><![CDATA[MACVector == 0x24]]></CondExp>
			</PSpec>
			<PSpec Name="Report New Monitor">
				<PSpecID>121</PSpecID>
				<LName>MAC Report New Monitor</LName>
				<SName>MAC Rpt New Mon</SName>
				<Desc>This frame is sent by a ring station to the configuration report server functional address to report that it has become the active monitor.</Desc>
				<CondExp><![CDATA[MACVector == 0x25]]></CondExp>
			</PSpec>
			<PSpec Name="Report NAUN Change">
				<PSpecID>122</PSpecID>
				<LName>MAC Report NAUN Change</LName>
				<SName>MAC Rpt NAUN Change</SName>
				<Desc>This frame is sent to the configuration report server functional address by any ring station that detects a change in the address of its nearest active upstream neighbor (NAUN) during neighbor notification.</Desc>
				<CondExp><![CDATA[MACVector == 0x26]]></CondExp>
			</PSpec>
			<PSpec Name="Report Neighbor Notif Inc">
				<PSpecID>123</PSpecID>
				<LName>MAC Report Neighbor Notif Inc</LName>
				<SName>MAC Rpt Nghbr Ntfy Inc</SName>
				<Desc>This frame is sent by the active monitor to the ring error monitor functional address when its T(neighbor_notification) expires before the completion of the previous neighbor-notification process.</Desc>
				<CondExp><![CDATA[MACVector == 0x27]]></CondExp>
			</PSpec>
			<PSpec Name="Report Mon Error">
				<PSpecID>124</PSpecID>
				<LName>MAC Report Monitor Error</LName>
				<SName>MAC Rpt Mon Err</SName>
				<Desc>This frame is sent to the ring error monitor functional address by the active monitor when it receives a Ring Purge or an Active Monitor Present MAC frame that it did not transmit, or when it receives a Claim Token MAC frame. It is also sent by a ring station in Claim Token Transmit mode if it receives a Claim Token MAC frame with its individual source address but a different NAUN.</Desc>
				<CondExp><![CDATA[MACVector == 0x28]]></CondExp>
			</PSpec>
			<PSpec Name="Report Soft Error">
				<PSpecID>125</PSpecID>
				<LName>MAC Report Soft Error</LName>
				<SName>MAC Rpt Soft Err</SName>
				<Desc>This frame is sent by a ring station to the ring error monitor functional address when a soft error is detected and T(soft_error_report) has expired. This enables the ring error monitor to maintain accurate error statistics.</Desc>
				<CondExp><![CDATA[MACVector == 0x29]]></CondExp>
			</PSpec>
			<PSpec Name="Report Transmit Forward">
				<PSpecID>126</PSpecID>
				<LName>MAC Report Transmit Forward</LName>
				<SName>MAC Rpt Xmit Fwd</SName>
				<Desc>This frame is sent by a ring station to the configuration report server functional address when it receives and forwards a Transmit Forward MAC frame.</Desc>
				<CondExp><![CDATA[MACVector == 0x2a]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="Token">
			<PSpecID>150</PSpecID>
			<LName>Token</LName>
			<SName>Token</SName>
			<Desc>In a Token Ring network, a token is a control signal that is passed from ring station to ring station between transfers of data. A ring station that is waiting to transmit data captures a token, changes it to the start of a frame, appends destination and source information and data to the frame, and passes it on. As the frame returns to its origin (having circled the ring), the originating ring station removes it from the ring and releases a new token for another ring station to capture and carry on the process. This is called single-token protocol, because only one token can circulate on the ring at any time.</Desc>
			<CondExp><![CDATA[FrameBits == 0x00 && (AccessControl & 0x10) == 0x00]]></CondExp>
		</PSpec>
		<PSpec Name="Token Ring LLC">
			<PSpecID>170</PSpecID>
			<LName>Token Ring LLC</LName>
			<SName>TR LLC</SName>
			<CondExp><![CDATA[      FrameBits == 0x40     ]]></CondExp>
			<NextLayer>
				<Exp><![CDATA[    ( ( PLD8[8] & 0x80 ) == 0x80 ) ? ( MLD8[0] & 0x1f ) : 0  ]]></Exp>
			</NextLayer>
			<Link Name="802.2 LLC"/>
			<PSpec Name="LAN Management" Sort="First">
				<PSpecID>160</PSpecID>
				<LName>LAN Management</LName>
				<SName>LAN Management</SName>
				<Desc> The LAN Management frame is used to carry information between management servers and the LAN manager. LAN management frames are transported between management servers and LAN managers using the services of the logical link control (LLC).</Desc>
				<CondExp><![CDATA[     MLD8[0] == 0xf4 || MLD8[1] == 0xf4 || MLD8[0] == 0xf5 || MLD8[1] == 0xf5     ]]></CondExp>
			</PSpec>
		</PSpec>
	</PSpec>
	<PSpec Name="Ethernet Type 2">
		<PSpecID>2</PSpecID>
		<LName>Ethernet Type 2</LName>
		<SName>EType2</SName>
		<Desc>Ethernet Type 2 is the second version of Ethernet that was defined by Xerox Parc, Digital Equipment Corporation and other industry leaders around 1980 and was subsequently superseded by the international standard 802.3. Some protocols, such as IP and DECnet were originally defined under Ethernet Type 2, and have never successfully (in terms of widespread usage) migrated to the newer standard on Ethernet. In terms of data bytes on the wire, Ethernet Type 2 uses bytes 13 and 14 as a protocol definition field, whereas the later standard used these bytes as a length field.</Desc>
		<Color>color_6</Color>
		<CondExp><![CDATA[ MLD16[12] > 1500 ]]></CondExp>
		<NextLayer>
			<Exp><![CDATA[    14    ]]></Exp>
		</NextLayer>
		<Definitions>
			<Define>
				<Name>EthernetType</Name>
				<Value><![CDATA[PLD16[12]]]></Value>
			</Define>
		</Definitions>
		<Link Name="Ethernet Type 2 Children"/>
	</PSpec>
	<PSpec Name="IPv6 Children" Type="CommonTable">
		<Link Name="IP Children"/>
	</PSpec>
	<PSpec Name="IP Children" Type="CommonTable">
		<PSpec Name="ICMP">
			<PSpecID>1100</PSpecID>
			<LName>Internet Control Message Protocol</LName>
			<SName>ICMP</SName>
			<Desc>IP gateways and hosts use ICMP to send reports of problems about datagrams back to the original source that sent the datagram. ICMP is only an error reporting mechanism: the actions taken by the transmitting nodes in response to the errors is not specified. ICMP also has an informational facility to test whether a destination is reachable and responding.</Desc>
			<Color>color_5</Color>
			<CondExp><![CDATA[ProtocolID == 1]]></CondExp>
			<Definitions>
				<Define>
					<Name>ICMPType</Name>
					<Value><![CDATA[MLD8[0]]]></Value>
				</Define>
			</Definitions>
			<PSpec Name="Echo Req">
				<PSpecID>1101</PSpecID>
				<LName>Internet Control Message Protocol - Echo Request</LName>
				<SName>PING Req</SName>
				<Desc>One method to test an IP network for problems is to use the ICMP Echo Request and Reply mechanism. This is also known as the ping mechanism. An Echo Request packet is sent with some optional arbitrary data to the target destination node. If the packet is routed successfully to the destination, the destination copies the data into an Echo Response packet and sends it back to the requesting node.</Desc>
				<CondExp><![CDATA[ICMPType == 8]]></CondExp>
			</PSpec>
			<PSpec Name="Echo Reply">
				<PSpecID>1102</PSpecID>
				<LName>Internet Control Message Protocol - Echo Reply</LName>
				<SName>PING Reply</SName>
				<DescID>1101</DescID>
				<CondExp><![CDATA[ICMPType == 0]]></CondExp>
			</PSpec>
			<PSpec Name="Dest Unreach">
				<PSpecID>1103</PSpecID>
				<LName>Internet Control Message Protocol - Destination Unreachable</LName>
				<SName>ICMP DestUnreach</SName>
				<Desc>Destination Unreachable</Desc>
				<CondExp><![CDATA[ICMPType == 3]]></CondExp>
			</PSpec>
			<PSpec Name="Time Exceed">
				<PSpecID>1104</PSpecID>
				<LName>Internet Control Message Protocol - Time Exceeded</LName>
				<SName>ICMP Time Ex</SName>
				<Desc>Time Exceeded</Desc>
				<CondExp><![CDATA[ICMPType == 11]]></CondExp>
			</PSpec>
			<PSpec Name="Redirect">
				<PSpecID>1105</PSpecID>
				<LName>Internet Control Message Protocol - Redirect</LName>
				<SName>ICMP Redirect</SName>
				<Desc>Redirection</Desc>
				<CondExp><![CDATA[ICMPType == 5]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="ICMPv6">
			<PSpecID>1120</PSpecID>
			<LName>Internet Control Message Protocol Version 6</LName>
			<SName>ICMPv6</SName>
			<DescID>1100</DescID>
			<Color>color_14</Color>
			<CondExp><![CDATA[ProtocolID == 58]]></CondExp>
			<PSpec Name="Echo Req">
				<PSpecID>1101</PSpecID>
				<CondExp><![CDATA[MLD8[0] == 128]]></CondExp>
			</PSpec>
			<PSpec Name="Echo Reply">
				<PSpecID>1102</PSpecID>
				<DescID>1101</DescID>
				<CondExp><![CDATA[MLD8[0] == 129]]></CondExp>
			</PSpec>
			<PSpec Name="Dest Unreach">
				<PSpecID>1103</PSpecID>
				<CondExp><![CDATA[MLD8[0] == 1]]></CondExp>
			</PSpec>
			<PSpec Name="Time Exceed">
				<PSpecID>1104</PSpecID>
				<CondExp><![CDATA[MLD8[0] == 3]]></CondExp>
			</PSpec>
			<PSpec Name="Redirect">
				<PSpecID>1105</PSpecID>
				<CondExp><![CDATA[MLD8[0] == 137]]></CondExp>
			</PSpec>
			<PSpec Name="Router Solicit">
				<PSpecID>1126</PSpecID>
				<LName>Internet Control Message Protocol - Router Solicitation</LName>
				<SName>ICMP RSol</SName>
				<Desc>Router Solicitation</Desc>
				<CondExp><![CDATA[MLD8[0] == 133]]></CondExp>
			</PSpec>
			<PSpec Name="Router Advert">
				<PSpecID>1127</PSpecID>
				<LName>Internet Control Message Protocol - Router Advertisement</LName>
				<SName>ICMP RAdv</SName>
				<Desc>Router Advertisement</Desc>
				<CondExp><![CDATA[MLD8[0] == 134]]></CondExp>
			</PSpec>
			<PSpec Name="Neighbor Solicit">
				<PSpecID>1128</PSpecID>
				<LName>Internet Control Message Protocol - Neighbor Solicitation</LName>
				<SName>ICMP NSol</SName>
				<Desc>Neighbor Solicitation</Desc>
				<CondExp><![CDATA[MLD8[0] == 135]]></CondExp>
			</PSpec>
			<PSpec Name="Neighbor Advert">
				<PSpecID>1129</PSpecID>
				<LName>Internet Control Message Protocol - Neighbor Advertisement</LName>
				<SName>ICMP NAdv</SName>
				<Desc>Neighbor Advertisement</Desc>
				<CondExp><![CDATA[MLD8[0] == 136]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="IGMP">
			<PSpecID>1150</PSpecID>
			<LName>Internet Group Management Protocol</LName>
			<SName>IGMP</SName>
			<Desc>To avoid having to broadcast packets to every node on an large IP network, IP multicasts are used. IGMP is an integral IP protocol which coordinates multicast addresses between IP internet gateways. In the first part of IGMP, a node sends an IGMP message to the all-hosts-multicast address declaring its membership in a new multicast group. In the second phase, multicast IP gateways poll their local network to see which hosts remain part of which groups.</Desc>
			<Color>color_8</Color>
			<CondExp><![CDATA[ProtocolID == 2]]></CondExp>
			<PSpec Name="IGAP">
				<PSpecID>1151</PSpecID>
				<LName>IGMP User Authentication Protocol</LName>
				<SName>IGAP</SName>
				<Desc>IGAP is designed to transport the information for user authentication and accounting, based on IGMPv2, for IP Multicast services.  IGAP adopts the IGMPv2 message format and extends it only slightly.</Desc>
				<CondExp><![CDATA[MLD8[8] == 16]]></CondExp>
			</PSpec>
			<PSpec Name="RGMP">
				<PSpecID>1152</PSpecID>
				<LName>Router-port Group Management Protocol</LName>
				<SName>RGMP</SName>
				<Desc>RGMP is designed to work in conjunction with multicast routing protocols where explicit join/prune to the distribution tree is performed. The RGMP message format resembles the IGMPv2 message format so that existing switches, capable of IGMP Snooping, can easily be enhanced with this feature.</Desc>
				<CondExp><![CDATA[PLD32[16] == 0xe0000019]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="EGP">
			<PSpecID>1300</PSpecID>
			<LName>Internet Exterior Gateway Protocol</LName>
			<SName>EGP</SName>
			<Desc>To avoid large and complex administration on a large IP internet, a collection of networks and/or gateways is deemed to be autonomous if it is managed by a single administration authority. EGP is used to share routing information between autonomous administration authorities and to list what IP addresses are reachable in its authority.</Desc>
			<Color>color_9</Color>
			<CondExp><![CDATA[ProtocolID == 8]]></CondExp>
		</PSpec>
		<PSpec Name="IGRP">
			<PSpecID>1350</PSpecID>
			<LName>Interior Gateway Routing Protocol</LName>
			<SName>IGRP</SName>
			<Desc>IGRP is a protocol that allows a number of gateways to coordinate their routing. IGRP is an internal gateways protocol, meaning that it is intended for use within a single set of networks, either under a single management or closely coordinated managements. IGRP keeps track of information about the internal topology and also about optimal routes. It should also respond quickly to changes, including those relate to network load and network errors. IGRP was developed for use with Cisco routers and its packets normally are found to originate from Cisco routers.</Desc>
			<Color>color_10</Color>
			<CondExp><![CDATA[ProtocolID == 9]]></CondExp>
		</PSpec>
		<PSpec Name="EIGRP">
			<PSpecID>1160</PSpecID>
			<LName>Enhanced Interior Gateway Routing Protocol</LName>
			<SName>EIGRP</SName>
			<Desc>EIGRP is an enhanced version of IGRP. Like IGRP, it is a distance vector protocol, and it uses the same composite metrics as IGRP. Unlike IGRP, transmitted distance vectors are nonperiodic, partial, and bounded. Because of this, EIGRP typically uses less bandwidth than IGRP.</Desc>
			<Color>color_10</Color>
			<CondExp><![CDATA[ProtocolID == 88]]></CondExp>
			<PSpec Name="Update">
				<PSpecID>1161</PSpecID>
				<LName>IP EIGRP Update</LName>
				<SName>EIGRP Update</SName>
				<Desc>EIGRP Update packets are the means by which route information is conveyed between and amongst routers. When updates are requested by a specific router, update packets are sent as unicast. When updates are required by multiple routers, such as upon a metric or topology change, update packets are sent multicast. Updates always use reliable delivery.</Desc>
				<CondExp><![CDATA[MLD8[1] == 1]]></CondExp>
			</PSpec>
			<PSpec Name="Query">
				<PSpecID>1162</PSpecID>
				<LName>IP EIGRP Query</LName>
				<SName>EIGRP Query</SName>
				<Desc>EIGRP Queries are sent by an EIGRP device&apos;s DUAL finite state machine in order to manage its diffusing computations. Queries can be either multicast or unicast, and must use reliable delivery.</Desc>
				<CondExp><![CDATA[MLD8[1] == 3]]></CondExp>
			</PSpec>
			<PSpec Name="Reply">
				<PSpecID>1163</PSpecID>
				<LName>IP EIGRP Reply</LName>
				<SName>EIGRP Reply</SName>
				<Desc>EIGRP Replies are sent by an EIGRP device&apos;s DUAL finite state machine in order to manage its diffusing computations. Replies are always unicast, and must use reliable delivery.</Desc>
				<CondExp><![CDATA[MLD8[1] == 4]]></CondExp>
			</PSpec>
			<PSpec Name="Hello">
				<PSpecID>1164</PSpecID>
				<LName>IP EIGRP Hello</LName>
				<SName>EIGRP Hello</SName>
				<Desc>EIGRP Hellos are used by the neighbor discovery and recovery. They are unicast, and use unreliable delivery.</Desc>
				<CondExp><![CDATA[MLD8[1] == 5]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="SCTP">
			<PSpecID>1900</PSpecID>
			<LName>Stream Control Transmission Protocol</LName>
			<SName>SCTP</SName>
			<Desc>The basic service offered by SCTP is the reliable transfer of user messages between peer SCTP users.  It performs this service within the context of an association between two SCTP endpoints.</Desc>
			<Color>color_7</Color>
			<CondExp><![CDATA[ProtocolID == 132]]></CondExp>
			<Definitions>
				<Define>
					<Name>SrcPort</Name>
					<Value><![CDATA[PLD16[0]]]></Value>
				</Define>
				<Define>
					<Name>DestPort</Name>
					<Value><![CDATA[PLD16[2]]]></Value>
				</Define>
			</Definitions>
		</PSpec>
		<PSpec Name="TCP">
			<PSpecID>1400</PSpecID>
			<LName>Internet Transmission Control Protocol</LName>
			<SName>TCP</SName>
			<Desc>TCP is one of the most prevalent IP protocols. It provides a reliable connection-oriented stream of data using full duplex communication between IP nodes using the positive acknowledgment with retransmission technique. When a connection is opened, packets are sequenced so that the receiving end of the connection can detect if packets are lost from the transmission.</Desc>
			<Color>color_6</Color>
			<CondExp><![CDATA[ProtocolID == 6]]></CondExp>
			<NextLayer>
				<Exp><![CDATA[     ((MLD8[12] & 0xf0) >> 2)     ]]></Exp>
			</NextLayer>
			<Definitions>
				<Define>
					<Name>TCPHdrLength</Name>
					<Value><![CDATA[((MLD8[12] & 0xf0) >> 2)]]></Value>
				</Define>
				<Define>
					<Name>SrcPort</Name>
					<Value><![CDATA[PLD16[0]]]></Value>
				</Define>
				<Define>
					<Name>DestPort</Name>
					<Value><![CDATA[PLD16[2]]]></Value>
				</Define>
			</Definitions>
			<Link Name="TCP/UDP" Sort="Last"/>
			<PSpec Name="HTTP">
				<PSpecID>1418</PSpecID>
				<LName>World Wide Web HTTP Protocol</LName>
				<SName>HTTP</SName>
				<Desc>The HTTP protocol is used to implement the World-Wide-Web (WWW) on the Internet and in that context normally runs as a sub-protocol of TCP/IP. HTTP has low overhead and hence high efficiency and was designed as a communication method for a distributed hypermedia information system. HTTP is stateless and object-oriented and contains a method for negotiating data representations which allows it to be easily extended to the development of new, more advanced, highly complex data representations.</Desc>
				<Color>color_14</Color>
				<CondExp><![CDATA[(SrcPort == 80) || (DestPort == 80)]]></CondExp>
			</PSpec>
			<PSpec Name="FTP">
				<PSpecID>1402</PSpecID>
				<LName>File Transfer Protocol</LName>
				<SName>FTP</SName>
				<Desc>FTP is the TCP/IP standard, high-level protocol for transferring files from one machine to another. It is usually implemented as a part of an application level program expressly for this purpose. FTP uses two well-known sockets, one for transferring the data between the machines (Data) and one for controlling and maintaining the connection (Control).</Desc>
				<Color>color_1</Color>
				<CondExp><![CDATA[(SrcPort == 20) || (DestPort == 20) || (SrcPort == 21) || (DestPort == 21)]]></CondExp>
				<PSpec Name="Data">
					<PSpecID>1408</PSpecID>
					<LName>File Transfer Protocol - Data</LName>
					<SName>FTP Data</SName>
					<DescID>1402</DescID>
					<CondExp><![CDATA[(SrcPort == 20) || (DestPort == 20)]]></CondExp>
				</PSpec>
				<PSpec Name="Control">
					<PSpecID>1407</PSpecID>
					<LName>File Transfer Protocol - Control</LName>
					<SName>FTP Ctl</SName>
					<DescID>1402</DescID>
					<CondExp><![CDATA[(SrcPort == 21) || (DestPort == 21)]]></CondExp>
				</PSpec>
			</PSpec>
			<PSpec Name="rtelnet">
				<PSpecID>2458</PSpecID>
				<LName>rtelnet - Remote Telnet service</LName>
				<SName>RTELNET</SName>
				<Desc>Remote User Telnet uses a SOCKS proxy server to provide access to the standard Telnet service through a firewall.</Desc>
				<Color>color_2</Color>
				<CondExp><![CDATA[(SrcPort == 107) || (DestPort == 107)]]></CondExp>
			</PSpec>
			<PSpec Name="TELNET">
				<PSpecID>1401</PSpecID>
				<LName>TELNET - Virtual Terminal Connection Service</LName>
				<SName>TELNET</SName>
				<Desc>TELNET is the TCP/IP standard protocol for remote terminal connection service. TELNET allows a user at one site to interact with a remote networked system at another site as if the user&apos;s terminal was directly attached to that remote machine.</Desc>
				<Color>color_2</Color>
				<CondExp><![CDATA[(SrcPort == 23) || (DestPort == 23)]]></CondExp>
			</PSpec>
			<PSpec Name="SMTP">
				<PSpecID>1409</PSpecID>
				<LName>Simple Mail Transfer Protocol</LName>
				<SName>SMTP</SName>
				<Desc>SMTP is the TCP/IP standard protocol for transferring electronic mail messages from one machine to another. SMTP specifies how two mail systems should interact and also specifies the format of the control messages they exchange in order to transfer mail with each other.</Desc>
				<Color>color_8</Color>
				<CondExp><![CDATA[(SrcPort == 25) || (DestPort == 25)]]></CondExp>
			</PSpec>
			<PSpec Name="WhoIs">
				<PSpecID>1448</PSpecID>
				<LName>WhoIs</LName>
				<SName>WhoIs</SName>
				<Desc>WhoIs is a simple TCP transaction based query/response server that provides rudimentary directory services to internet users. Typically, a WhoIs server running on a host maintains a database of information on users of that server. Clients then connect to to this server to request information on a particular user. WhoIs uses IP port 43.</Desc>
				<CondExp><![CDATA[(SrcPort == 43) || (DestPort == 43)]]></CondExp>
			</PSpec>
			<PSpec Name="IMAP">
				<PSpecID>1450</PSpecID>
				<LName>Internet Message Access Protocol</LName>
				<SName>IMAP</SName>
				<Desc>IMAP may be thought of as a functional superset of Post Office Protocol version 2 (POP2). Like POP2, IMAP specifies a means of accessing stored electronic mail from a server. IMAP version 2 and 4 servers listen on TCP port 143. IMAP 3 uses TCP port 220.</Desc>
				<CondExp><![CDATA[(SrcPort == 143) || (DestPort == 143)]]></CondExp>
			</PSpec>
			<PSpec Name="BGP">
				<PSpecID>1451</PSpecID>
				<LName>Border Gateway Protocol</LName>
				<SName>BGP</SName>
				<Desc>The Border Gateway Protocol (BGP) is an inter-Autonomous System routing protocol. The primary function of a BGP speaking system is to exchange network reachability information with other BGP systems. BGP uses TCP port 179.</Desc>
				<CondExp><![CDATA[(SrcPort == 179) || (DestPort == 179)]]></CondExp>
			</PSpec>
			<PSpec Name="IMAP3">
				<PSpecID>1452</PSpecID>
				<LName>Internet Message Access Protocol 3</LName>
				<SName>IMAP3</SName>
				<Desc>IMAP may be thought of as a functional superset of Post Office Protocol version 2 (POP2). Like POP2, IMAP specifies a means of accessing stored electronic mail from a server. IMAP version 2 and 4 servers listen on TCP port 143. IMAP 3 uses TCP port 220.</Desc>
				<CondExp><![CDATA[(SrcPort == 220) || (DestPort == 220)]]></CondExp>
			</PSpec>
			<PSpec Name="GOPHER">
				<PSpecID>1416</PSpecID>
				<LName>GOPHER Protocol</LName>
				<SName>GOPHER</SName>
				<Desc>GOPHER is a TCP/IP standard protocol for locating information on an IP internet and is most frequently found in use on the Internet. The GOPHER protocol is designed primarily to act as a distributed document delivery system. While documents and services reside on many different servers, GOPHER client software presents users with a hierarchy of items and directories much like a file system. The GOPHER protocol allows some facility for performing remote searches in the document database at its disposal.</Desc>
				<Color>color_12</Color>
				<CondExp><![CDATA[(SrcPort == 70) || (DestPort == 70)]]></CondExp>
			</PSpec>
			<PSpec Name="Finger">
				<PSpecID>1417</PSpecID>
				<LName>Finger Protocol</LName>
				<SName>Finger</SName>
				<Desc>Finger is a TCP/IP standard protocol for retrieving information about users on an IP internet. Using a well-known port, a remote server is queried about a user and the remote normally responds with predetermined to be allowable information. The duration of a Finger connection is therefore usually quite short.</Desc>
				<Color>color_13</Color>
				<CondExp><![CDATA[(SrcPort == 79) || (DestPort == 79)]]></CondExp>
			</PSpec>
			<PSpec Name="POP2">
				<PSpecID>1422</PSpecID>
				<LName>Post Office Protocol - Version 2</LName>
				<SName>POP2</SName>
				<Desc>POP is a TCP/IP standard protocol for retrieving mail from a local mail delivery system. It is typically used on workstations which do not choose to be mail servers in a larger mail delivery system. In typical applications, POP allows workstations to send and retrieve mail to and from a server that will hold and otherwise process that mail on behalf of the workstation.</Desc>
				<Color>color_3</Color>
				<CondExp><![CDATA[(SrcPort == 109) || (DestPort == 109)]]></CondExp>
			</PSpec>
			<PSpec Name="POP3">
				<PSpecID>1405</PSpecID>
				<LName>Post Office Protocol - Version 3</LName>
				<SName>POP3</SName>
				<DescID>1422</DescID>
				<Color>color_3</Color>
				<CondExp><![CDATA[(SrcPort == 110) || (DestPort == 110)]]></CondExp>
			</PSpec>
			<PSpec Name="NNTP">
				<PSpecID>1406</PSpecID>
				<LName>Network News Transfer Protocol</LName>
				<SName>NNTP</SName>
				<Desc>NNTP specifies a protocol for the distribution, inquiry, retrieval, and posting of news articles using a reliable stream-based transmission of news among the ARPA-Internet community. NNTP is designed so that news articles are stored in a central database allowing a subscriber to select only those items he wishes to read. Indexing, cross-referencing, and expiration of aged messages are also provided.</Desc>
				<Color>color_4</Color>
				<CondExp><![CDATA[(SrcPort == 119) || (DestPort == 119)]]></CondExp>
			</PSpec>
			<PSpec Name="AFP">
				<PSpecID>1428</PSpecID>
				<LName>AFP Services Over TCP/IP</LName>
				<SName>AFP</SName>
				<Desc>AFP is the AppleTalk Filing Protocol which is used for AppleShare services. Beginning with version 2.2 which began shipping in May 1997, AFP was translated so that it could use the IP protocol stack for datagrams and session services. Previously it worked only on the AppleTalk Protocol stack using ATP and ASP. By using the IP protocol stack, AppleShare can potentially be available between machines anywhere on the Internet WAN.</Desc>
				<Color>color_3</Color>
				<CondExp><![CDATA[(SrcPort == 548) || (DestPort == 548)]]></CondExp>
			</PSpec>
			<PSpec Name="Cayman IP ATalk">
				<PSpecID>1423</PSpecID>
				<LName>AppleTalk DDP Embedded In IP - Cayman Tunnel Technique</LName>
				<SName>Cayman</SName>
				<Desc>In environments where all protocol traffic must be IP datagrams, several methods have been developed to embed or tunnel other protocols inside of IP datagrams. Cayman IP AppleTalk is one method used to embed AppleTalk DDP packets inside of IP. This technique is typically used by Cayman Systems hardware and software products such as the Gatorbox.</Desc>
				<Color>color_12</Color>
				<CondExp><![CDATA[(SrcPort == 910) || (DestPort == 910)]]></CondExp>
			</PSpec>
			<PSpec Name="X-Windows">
				<PSpecID>1475</PSpecID>
				<LName>X-Windows Server</LName>
				<SName>X-Windows</SName>
				<Desc>X Windows operates over TCP, typically using server port numbers starting with 6000.</Desc>
				<CondExp><![CDATA[(SrcPort == 6000) || (DestPort == 6000)]]></CondExp>
			</PSpec>
			<PSpec Name="TNS">
				<PSpecID>1476</PSpecID>
				<LName>Transparent Network Substrate</LName>
				<SName>TNS</SName>
				<Desc>TNS allows peer-to-peer connectivity where no machine-level connectivity can occur. It provides a user-transparent layer that enables a heterogeneous network consisting of different protocols to function as a homogeneous network. TNS forms a transparent layer to which different network protocols are connected. It provides a network of applications above the existing networks of computers.</Desc>
				<CondExp><![CDATA[(SrcPort == 1521) || (DestPort == 1521)]]></CondExp>
			</PSpec>
			<PSpec Name="TDS">
				<PSpecID>2492</PSpecID>
				<LName>Tabular Data Stream</LName>
				<SName>TDS</SName>
				<Desc>The Tabular Data Stream (TDS) is an application level protocol used to send requests and responses between clients and servers. A client&apos;s request may contain multiple commands. The response from the server may return one or many result sets. TDS relies on a connection oriented transport service. Session, presentation, and application service elements are provided by TDS. TDS does not require any specific transport provider. It can be implemented over multiple transport protocols if they provide connection oriented service.</Desc>
				<CondExp><![CDATA[(SrcPort == 1433) || (DestPort == 1433)]]></CondExp>
			</PSpec>
			<PSpec Name="LDAPS">
				<PSpecID>2493</PSpecID>
				<LName>Secure Lightweight Directory Access Protocol</LName>
				<SName>LDAPS</SName>
				<DescID>1473</DescID>
				<CondExp><![CDATA[(SrcPort == 636) || (DestPort == 636)]]></CondExp>
			</PSpec>
			<PSpec Name="IMAPS">
				<PSpecID>2494</PSpecID>
				<LName>Secure Internet Message Access Protocol</LName>
				<SName>IMAPS</SName>
				<Desc>IMAP may be thought of as a functional superset of Post Office Protocol version 2 (POP2). Like POP2, IMAP specifies a means of accessing stored electronic mail from a server. IMAPS uses port 993.</Desc>
				<CondExp><![CDATA[(SrcPort == 993) || (DestPort == 993)]]></CondExp>
			</PSpec>
			<PSpec Name="SCCP">
				<PSpecID>2495</PSpecID>
				<LName>Skinny Client Control Protocol</LName>
				<SName>SCCP</SName>
				<Desc>An H.323 proxy can be used to communicate with a Skinny Client using the SCCP.  The skinny client (i.e. an Ethernet Phone) uses TCP/IP to transmit and receive calls and RTP/UDP/IP to/from a Skinny Client or H.323 terminal for audio.  Skinny messages are carried over TCP and use port 2000.</Desc>
				<CondExp><![CDATA[(SrcPort == 2000) || (DestPort == 2000)]]></CondExp>
			</PSpec>
			<PSpec Name="Gnutella">
				<PSpecID>2496</PSpecID>
				<LName>Gnutella</LName>
				<SName>Gnutella</SName>
				<Desc>Gnutella is a file-sharing protocol allows users to share information by directly connecting to each other forming a high-level network.  Gnutella packets are carried over TCP and use port 6346 and 6347.</Desc>
				<CondExp><![CDATA[(SrcPort == 6346) || (DestPort == 6346) || (SrcPort == 6347) || (DestPort == 6347)]]></CondExp>
			</PSpec>
			<PSpec Name="iSCSI">
				<PSpecID>2497</PSpecID>
				<LName>internet Small Computer Systems Interface</LName>
				<SName>iSCSI</SName>
				<Desc>The Small Computer Systems Interface (SCSI) is a popular family of protocols for communicating with I/O devices, especially storage devices. This document describes a transport protocol for SCSI that works on top of TCP. The iSCSI protocol aims to be fully compliant with the rules laid out in the SCSI Architecture Model - 2 [SAM2] document. The current version of iSCSI is 0.  iSCSI packets are carried over TCP and use port 3360.</Desc>
				<CondExp><![CDATA[(SrcPort == 3260) || (DestPort == 3260)]]></CondExp>
			</PSpec>
			<PSpec Name="LPD">
				<PSpecID>2499</PSpecID>
				<LName>Line Printer Daemon</LName>
				<SName>LPD</SName>
				<Desc>The LPR/LPD printing protocol [LPD] is used with BSD UNIX systems in the client-server-printer configuration.  Usage of the Job Monitoring MIB with LPR/LPD will most likely conform to Configuration 3, where the monitor application or the server uses SNMP to obtain job information from the printer.  The client communicates with the UNIX server using the existing LPD protocol to obtain job information. The LPR/LPD protocol is also used in the Windows environment to implement peer-to-peer printing.</Desc>
				<CondExp><![CDATA[(SrcPort == 515) || (DestPort == 515)]]></CondExp>
			</PSpec>
			<PSpec Name="ISO-8073">
				<PSpecID>2505</PSpecID>
				<LName>ISO Transport Protocol 8073</LName>
				<SName>ISO-TP-8073</SName>
				<Desc>The ISO 8073 standard describes the ISO Transport Protocol Specification (TP). The ISO Transport Protocol specifies common encoding rules and a number of classes of transport protocol procedure which can be used with different network Quality of Service.</Desc>
				<CondExp><![CDATA[( ((SrcPort == 0x66) || (DestPort == 0x66)) && (MLD16[0] != 0) )]]></CondExp>
			</PSpec>
			<PSpec Name="DCE">
				<PSpecID>2510</PSpecID>
				<LName>Distributed Computing Environment</LName>
				<SName>DCE</SName>
				<Color>color_8</Color>
				<Desc>DCE provides tools and services that support distributed applications. DCE is based on three distributed computing models - client/server, remote procedure call, and data sharing.</Desc>
				<CondExp><![CDATA[(((SrcPort == 0x87) || (DestPort == 0x87)) || ((MLD16[0] == 0x0500) && (MLD8[2] < 20))) && (MLD16[0] != 0)  ]]></CondExp>
			</PSpec>
			<PSpec Name="Fibre Channel">
				<PSpecID>2520</PSpecID>
				<LName>Fibre Channel</LName>
				<SName>FC</SName>
				<Color>color_8</Color>
				<Desc>FCIP mechanisms enable the transmission of Fibre Channel (FC) information by tunneling data between storage area network (SAN) facilities over IP networks; this capacity facilitates data sharing over a geographically distributed enterprise. Fibre Channel is suited for connecting servers to shared storage devices and for interconnecting storage controllers and drives.</Desc>
				<CondExp><![CDATA[ ((SrcPort == 0xc99) || (DestPort == 0xc99)) && (MLD16[0] != 0) && (MLD8[0] == 1) ]]></CondExp>
			</PSpec>			
		</PSpec>
		<PSpec Name="UDP">
			<PSpecID>1500</PSpecID>
			<LName>Internet User Datagram Protocol</LName>
			<SName>UDP</SName>
			<Desc>Using 16-bit port numbers, UDP provides a method to distinguish between multiple application and process destinations inside a single IP node. Unlike TCP, UDP does not add any functionality to basic IP datagrams, but simply helps to identify the application which should be handling the UDP packets that are received.</Desc>
			<Color>color_7</Color>
			<CondExp><![CDATA[ProtocolID == 17]]></CondExp>
			<NextLayer>
				<Exp><![CDATA[     8     ]]></Exp>
			</NextLayer>
			<Definitions>
				<Define>
					<Name>SrcPort</Name>
					<Value><![CDATA[PLD16[0]]]></Value>
				</Define>
				<Define>
					<Name>DestPort</Name>
					<Value><![CDATA[PLD16[2]]]></Value>
				</Define>
			</Definitions>
			<Link Name="TCP/UDP"/>
			<PSpec Name="FSP">
				<PSpecID>1502</PSpecID>
				<LName>Sneaky File Transfer Protocol</LName>
				<SName>FSP</SName>
				<Desc>FSP is dubbed the Sneaky File Transfer Protocol. It uses UDP port 21 to implement a service similar to FTP. It is unofficial, and is mainly used by hackers to move their ill-gotten gains around [Ches94]. Discovery of FSP traffic will therefore probably be a cause for concern.</Desc>
				<Color>color_1</Color>
				<CondExp><![CDATA[(SrcPort == 20) || (DestPort == 20) || (SrcPort == 21) || (DestPort == 21)]]></CondExp>
				<PSpec Name="Data">
					<PSpecID>1508</PSpecID>
					<LName>Sneaky File Transfer Protocol - Data</LName>
					<SName>FSP Data</SName>
					<DescID>1502</DescID>
					<CondExp><![CDATA[(SrcPort == 20) || (DestPort == 20)]]></CondExp>
				</PSpec>
				<PSpec Name="Control">
					<PSpecID>1507</PSpecID>
					<LName>Sneaky File Transfer Protocol - Control</LName>
					<SName>FSP Ctl</SName>
					<DescID>1502</DescID>
					<CondExp><![CDATA[(SrcPort == 21) || (DestPort == 21)]]></CondExp>
				</PSpec>
			</PSpec>
			<PSpec Name="TFTP">
				<PSpecID>1515</PSpecID>
				<LName>Trivial File Transfer Protocol</LName>
				<SName>TFTP</SName>
				<Desc>TFTP is another TCP/IP standard protocol for transferring files from one machine to another. It has limited capabilities and minimal overhead and files are transferred using UDP, an unreliable connectionless delivery service. It is used in situations where memory and program size are highly restricted. It is often used in conjunction with BOOTP to load executable images into diskless workstations.</Desc>
				<Color>color_11</Color>
				<CondExp><![CDATA[(SrcPort == 69) || (DestPort == 69)]]></CondExp>
			</PSpec>
			<PSpec Name="HSRP">
				<PSpecID>1458</PSpecID>
				<LName>Hot Standby Router Protocol</LName>
				<SName>HSRP</SName>
				<Desc>The Hot Standby Router Protocol, HSRP, provides a mechanism which is designed to support non-disruptive failover of IP traffic in certain circumstances. In particular, the protocol protects against the failure of the first hop router when the source host cannot learn the IP address of the first hop router dynamically. Using HSRP, a set of routers work in concert to present the illusion of a single virtual router to the hosts on the LAN. A single router (known as the active router) is elected by the group, and is responsible for forwarding the packets that hosts send to the virtual router. HSRP is patented by Cisco Systems, Inc. HSRP uses UDP port 1985.</Desc>
				<CondExp><![CDATA[(SrcPort == 1985) || (DestPort == 1985)]]></CondExp>
			</PSpec>
			<PSpec Name="L2F">
				<PSpecID>1564</PSpecID>
				<LName>Layer Two Forwarding</LName>
				<SName>L2F</SName>
				<Desc>L2F permits the tunneling of the link layer (i.e., HDLC, or SLIP frames) of higher level protocols. Using such tunnels, it is possible to divorce the location of the initial dial-up server from the location at which the dial-up protocol connection is terminated and access to the network provided. L2F uses IP port 1701.</Desc>
				<CondExp><![CDATA[(SrcPort == 1701 && (MLD8[1] & 0x0f) == 1) || (DestPort == 1701 && (MLD8[3] & 0x0f) == 1)]]></CondExp>
			</PSpec>
			<PSpec Name="NTP">
				<PSpecID>1503</PSpecID>
				<LName>Network Time Protocol</LName>
				<SName>NTP</SName>
				<Desc>NTP provides the mechanisms to synchronize time and coordinate time distribution in a large, diverse internet operating at many different rates. It uses a returnable-time design in which a distributed subnet of time servers operating in a self-organizing, hierarchical-master-slave configuration synchronizes local clocks within the subnet and to national time standards via wire or radio. The servers can also redistribute reference time via local routing algorithms and time daemons.</Desc>
				<Color>color_5</Color>
				<CondExp><![CDATA[(SrcPort == 123) || (DestPort == 123)]]></CondExp>
			</PSpec>
			<PSpec Name="SNMP">
				<PSpecID>1519</PSpecID>
				<LName>Simple Network Management Protocol</LName>
				<SName>SNMP</SName>
				<Desc>SNMP helps network managers locate and correct problems in a network environment, usually related to larger internet operations. One or more SNMP agents execute on remote nodes so that SNMP clients may contact them and collect data and status about their network performance and in some cases, about other server-related data and processes as well. Each server maintains a data structure called a MIB (Management Information Base) which is a set of conceptual variables such as counts of packets, average packet size, number of errors of different types, busiest nodes, etc. which apply to that particular server.</Desc>
				<Color>color_8</Color>
				<CondExp><![CDATA[(SrcPort == 161) || (DestPort == 161)]]></CondExp>
			</PSpec>
			<PSpec Name="SNMP Trap">
				<PSpecID>1520</PSpecID>
				<LName>Simple Network Management Protocol - Trap</LName>
				<SName>SNMP Trap</SName>
				<DescID>1519</DescID>
				<Color>color_8</Color>
				<CondExp><![CDATA[(SrcPort == 162) || (DestPort == 162)]]></CondExp>
			</PSpec>
			<PSpec Name="RIP">
				<PSpecID>1504</PSpecID>
				<LName>Routing Information Protocol</LName>
				<SName>RIP</SName>
				<Desc>RIP is a protocol which began with Berkeley 4.x BSD Unix systems as a method to exchange routing information among a small set of computers. Usually, all the participating machines are attached to the same local area network.</Desc>
				<Color>color_11</Color>
				<CondExp><![CDATA[(SrcPort == 520) || (DestPort == 520)]]></CondExp>
				<PSpec Name="RIPv1">
					<PSpecID>1590</PSpecID>
					<LName>Routing Information Protocol version 1</LName>
					<SName>RIPv1</SName>
					<DescID>1504</DescID>
					<CondExp><![CDATA[MLD8[1] == 1]]></CondExp>
				</PSpec>
				<PSpec Name="RIPv2">
					<PSpecID>1591</PSpecID>
					<LName>Routing Information Protocol version 2</LName>
					<SName>RIPv2</SName>
					<DescID>1504</DescID>
					<CondExp><![CDATA[MLD8[1] == 2]]></CondExp>
				</PSpec>
				<PSpec Name="RIPv3">
					<PSpecID>1592</PSpecID>
					<LName>Routing Information Protocol version 3</LName>
					<SName>RIPv3</SName>
					<DescID>1504</DescID>
					<CondExp><![CDATA[MLD8[1] == 3]]></CondExp>
				</PSpec>
				<PSpec Name="RIPv4">
					<PSpecID>1593</PSpecID>
					<LName>Routing Information Protocol version 4</LName>
					<SName>RIPv4</SName>
					<DescID>1504</DescID>
					<CondExp><![CDATA[MLD8[1] == 4]]></CondExp>
				</PSpec>
			</PSpec>
			<PSpec Name="RADIUS Accounting">
				<PSpecID>2566</PSpecID>
				<LName>RADIUS Accounting</LName>
				<SName>RADIUS Acct</SName>
				<Desc>When a client is configured to use RADIUS Accounting, at the start of service delivery it will generate an Accounting Start packet describing the type of service being delivered and the user it is being delivered to, and will send that to the RADIUS Accounting server, which will send back an acknowledgement that the packet has been received. At the end of service delivery the client will generate an Accounting Stop packet describing the type of service that was delivered and optionally statistics such as elapsed time, input and output octets, or input and output packets. It will send that to the RADIUS Accounting server, which will send back an acknowledgement that the packet has been received.</Desc>
				<CondExp><![CDATA[(SrcPort == 1813) || (DestPort == 1813)]]></CondExp>
			</PSpec>
			<PSpec Name="RADIUS">
				<PSpecID>1461</PSpecID>
				<LName>RADIUS</LName>
				<SName>RADIUS</SName>
				<Desc>RADIUS (Remote Authentication Dial In User Service) is a protocol for carrying authentication, authorization, and configuration information between a Network Access Server which desires to authenticate its links and a shared Authentication Server. RADIUS uses UDP ports 1812 (for authorization) and 1813 (for accounting). Early deployments of RADIUS erroneously used ports 1645 and 1646.</Desc>
				<CondExp><![CDATA[(SrcPort == 1645) || (SrcPort == 1646) || (SrcPort == 1812) || (DestPort == 1645) || (DestPort == 1646) || (DestPort == 1812)]]></CondExp>
			</PSpec>
			<PSpec Name="ISAKMP">
				<PSpecID>1464</PSpecID>
				<LName>Internet Security Association and Key Management Protocol</LName>
				<SName>ISAKMP</SName>
				<Desc>ISAKMP defines procedures and packet formats to establish, negotiate, modify and delete Security Associations. SAs contain all the information required for execution of various network security services, such as the IP layer services (such as header authentication and payload encapsulation), transport or application layer services, or self-protection of negotiation traffic. ISAKMP defines payloads for exchanging key generation and authentication data.</Desc>
				<CondExp><![CDATA[(SrcPort == 500) || (DestPort == 500)]]></CondExp>
			</PSpec>
			<PSpec Name="Mobile IP">
				<PSpecID>1466</PSpecID>
				<LName>Mobile IP</LName>
				<SName>Mobile IP</SName>
				<Desc>Mobile IP defines a mechanism which enables IPv4 nodes to change their point of attachment to the Internet without changing their IP address.</Desc>
				<CondExp><![CDATA[(SrcPort == 434) || (DestPort == 434)]]></CondExp>
			</PSpec>
			<PSpec Name="BACnet">
				<PSpecID>1467</PSpecID>
				<LName>Building Automation and Control Network</LName>
				<SName>BACnet</SName>
				<Desc>Developed under the auspices of the American Society of Heating, Refrigerating and Air-Conditioning Engineers (ASHRAE), BACnet is an American national standard, a European pre-standard, and an ISO global standard.</Desc>
				<CondExp><![CDATA[(SrcPort == 47808) || (DestPort == 47808)]]></CondExp>
			</PSpec>
			<PSpec Name="WTP + WSP">
				<PSpecID>1468</PSpecID>
				<LName>Wireless Transaction Protocol + Wireless Session Protocol</LName>
				<SName>WTP + WSP</SName>
				<Desc>The wireless application protocol (WAP) has been developed to provide an industry standard specification for developing applications and services, which operate over wireless networks.</Desc>
				<CondExp><![CDATA[(SrcPort == 9201) || (DestPort == 9201)]]></CondExp>
			</PSpec>
			<PSpec Name="AppleTalk Tunnel">
				<PSpecID>7700</PSpecID>
				<LName>AppleTalk Embedded In Internet Protocol</LName>
				<SName>ATalk</SName>
				<Desc>In environments where all protocol traffic must be IP datagrams, several methods have been developed to embed or tunnel other protocols inside of IP datagrams. Many of these methods were developed by Apple Computer.</Desc>
				<Color>color_14</Color>
				<CondExp><![CDATA[SrcPort == 387 || DestPort == 387 || ((SrcPort >= 200 && SrcPort <= 209) || (DestPort >= 200 && DestPort <= 209))]]></CondExp>
				<PSpec Name="Short DDP">
					<PSpecID>7771</PSpecID>
					<LName>Short DDP Embedded In Internet Protocol</LName>
					<SName>Short DDP</SName>
					<DescID>7300</DescID>
					<Color>color_2</Color>
					<CondExp><![CDATA[MLD16[20] == 1]]></CondExp>
				</PSpec>
				<PSpec Name="Long DDP">
					<PSpecID>7772</PSpecID>
					<LName>Long DDP Embedded In Internet Protocol</LName>
					<SName>Long DDP</SName>
					<DescID>7300</DescID>
					<Color>color_3</Color>
					<CondExp><![CDATA[MLD16[20] == 2]]></CondExp>
				</PSpec>
				<PSpec Name="AURP">
					<PSpecID>7773</PSpecID>
					<LName>AppleTalk Update-based Routing Protocol</LName>
					<SName>AURP</SName>
					<Desc> AURP (AppleTalk Update Routing Protocol) is used for connecting AppleTalk routers on a wide area IP network. Information is exchanged between AppleTalk routers only as needed instead of being exchanged at regular timed intervals.</Desc>
					<Color>color_4</Color>
					<CondExp><![CDATA[MLD16[20] == 3]]></CondExp>
					<PSpec Name="RI Req">
						<PSpecID>7774</PSpecID>
						<LName>AURP Routing Information Request</LName>
						<SName>AURP RIReq</SName>
						<Desc>After an AURP connection has been opened, the node which issued the Open Request may request the sender to send it routing information using the Routing Information Request. Once received, the data sender sends a sequence of Routing Information Response packets which contain all the relevant routing information.</Desc>
						<Color>color_5</Color>
						<CondExp><![CDATA[MLD16[26] == 1]]></CondExp>
					</PSpec>
					<PSpec Name="RI Rsp">
						<PSpecID>7775</PSpecID>
						<LName>AURP Routing Information Response</LName>
						<SName>AURP RIRsp</SName>
						<DescID>7774</DescID>
						<Color>color_6</Color>
						<CondExp><![CDATA[MLD16[26] == 2]]></CondExp>
					</PSpec>
					<PSpec Name="RI Ack">
						<PSpecID>7776</PSpecID>
						<LName>AURP Routing Information Acknowledgment</LName>
						<SName>AURP RIAck</SName>
						<Desc>Under AURP, a Routing Information Acknowledgment packet is sent by the receiver for each Routing Information Response or Routing Information Update packet which is received.</Desc>
						<Color>color_7</Color>
						<CondExp><![CDATA[MLD16[26] == 3]]></CondExp>
					</PSpec>
					<PSpec Name="RI Update">
						<PSpecID>7777</PSpecID>
						<LName>AURP Routing Information Update</LName>
						<SName>AURP RIUpd</SName>
						<Desc>Under AURP, once a router has reliably received the routing and zone information from another router, it can indicate that it would like to be updated whenever that information changes. The Routing Information Update packet is used to send the updated information.</Desc>
						<Color>color_8</Color>
						<CondExp><![CDATA[MLD16[26] == 4]]></CondExp>
					</PSpec>
					<PSpec Name="Router Down">
						<PSpecID>7778</PSpecID>
						<LName>AURP Router Down Packet</LName>
						<SName>AURP RDwn</SName>
						<Desc>Under AURP, if a router determines that it is going down or going to become inactive it must notify all other routers in its informed routers list of this fact. The Router DOwn packet is used for this purpose.</Desc>
						<Color>color_9</Color>
						<CondExp><![CDATA[MLD16[26] == 5]]></CondExp>
					</PSpec>
					<PSpec Name="Zone Req">
						<PSpecID>7779</PSpecID>
						<LName>AURP Zone Request</LName>
						<SName>AURP ZoneReq</SName>
						<Desc>After an AURP connection has been opened and routing information has been requested and sent, the node which issued the Open Request may request the sender to send it zone information associated with the networks about which it has just learned. To do this it uses the Zone Information Request. The information is returned in a sequence of Zone Information Response packets.</Desc>
						<Color>color_10</Color>
						<CondExp><![CDATA[MLD16[26] == 6]]></CondExp>
					</PSpec>
					<PSpec Name="Zone Rsp">
						<PSpecID>7780</PSpecID>
						<LName>AURP Zone Response</LName>
						<SName>AURP ZoneRsp</SName>
						<DescID>7779</DescID>
						<Color>color_11</Color>
						<CondExp><![CDATA[MLD16[26] == 7]]></CondExp>
					</PSpec>
					<PSpec Name="Open Req">
						<PSpecID>7781</PSpecID>
						<LName>AURP Open Request</LName>
						<SName>AURP OpenReq</SName>
						<Desc>Under AURP, a router receiving the Open Request takes on the role of data sender within the one-way connection. It must respond with an Open Response or signal some kind of error why it can not open the connection.</Desc>
						<Color>color_12</Color>
						<CondExp><![CDATA[MLD16[26] == 8]]></CondExp>
					</PSpec>
					<PSpec Name="Open Rsp">
						<PSpecID>7782</PSpecID>
						<LName>AURP Open Response</LName>
						<SName>AURP OpenRsp</SName>
						<DescID>7781</DescID>
						<Color>color_13</Color>
						<CondExp><![CDATA[MLD16[26] == 9]]></CondExp>
					</PSpec>
					<PSpec Name="Tickle">
						<PSpecID>7783</PSpecID>
						<LName>AURP Tickle</LName>
						<SName>AURP Tickle</SName>
						<Desc>Under AURP, Tickle packets are sent by the data receiver because they are used to verify that the data received is still valid. The Tickle Ack packets are sent by the data sender to show that the Tickle has been received.</Desc>
						<Color>color_14</Color>
						<CondExp><![CDATA[MLD16[26] == 14]]></CondExp>
					</PSpec>
					<PSpec Name="Tickle Ack">
						<PSpecID>7784</PSpecID>
						<LName>AURP Tickle Ack</LName>
						<SName>AURP TAck</SName>
						<DescID>7783</DescID>
						<Color>color_2</Color>
						<CondExp><![CDATA[MLD16[26] == 15]]></CondExp>
					</PSpec>
				</PSpec>
			</PSpec>
			<PSpec Name="Megaco">
				<PSpecID>7800</PSpecID>
				<LName>Megaco Text / H.248</LName>
				<SName>Megaco</SName>
				<Desc>Megaco is the protocol used for interfacting between external call agents called Media Gateway Controllers and Media Gateways.</Desc>
				<Color>color_13</Color>
				<CondExp><![CDATA[ ((MLD32[0] == 0x4D454741) || ((SrcPort == 0xb80) || (DestPort == 0xb80))) ]]></CondExp>
			</PSpec>
			<PSpec Name="RTP" Sort="Last">
				<PSpecID>2670</PSpecID>
				<LName>Real-Time Transport Protocol</LName>
				<SName>RTP</SName>
				<Desc>RTP provides end-to-end network transport functions suitable for applications transmitting real-time data, such as audio, video or simulation data, over multicast or unicast network services.</Desc>
				<CondExp><![CDATA[ ((MLD8[0] & 0xc0) == 0x80) && (((MLD8[1] & 0x7f) == 0) || ((MLD8[1] & 0x7f) == 3) || ((MLD8[1] & 0x7f) == 4) || ((MLD8[1] & 0x7f) == 8) || ((MLD8[1] & 0x7f) == 9) || ((MLD8[1] & 0x7f) == 15) || ((MLD8[1] & 0x7f) == 18) || ((MLD8[1] & 0x7f) == 31) || ((MLD8[1] & 0x7f) == 34))]]></CondExp>
				<PSpec Name="G.711">
					<PSpecID>2680</PSpecID>
					<LName>G.711</LName>
					<SName>G.711</SName>
					<DescID>2670</DescID>
					<CondExp><![CDATA[((MLD8[1] & 0x7f) == 0) || ((MLD8[1] & 0x7f) == 8)]]></CondExp>
				</PSpec>
				<PSpec Name="G.723">
					<PSpecID>2681</PSpecID>
					<LName>G.723</LName>
					<SName>G.723</SName>
					<DescID>2670</DescID>
					<CondExp><![CDATA[(MLD8[1] & 0x7f) == 4]]></CondExp>
				</PSpec>
				<PSpec Name="G.728">
					<PSpecID>2682</PSpecID>
					<LName>G.728</LName>
					<SName>G.728</SName>
					<DescID>2670</DescID>
					<CondExp><![CDATA[(MLD8[1] & 0x7f) == 15]]></CondExp>
				</PSpec>
				<PSpec Name="G.729">
					<PSpecID>2683</PSpecID>
					<LName>G.729</LName>
					<SName>G.729</SName>
					<DescID>2670</DescID>
					<CondExp><![CDATA[(MLD8[1] & 0x7f) == 18]]></CondExp>
				</PSpec>
				<PSpec Name="H.261">
					<PSpecID>2684</PSpecID>
					<LName>H.261</LName>
					<SName>H.261</SName>
					<DescID>2670</DescID>
					<CondExp><![CDATA[(MLD8[1] & 0x7f) == 31]]></CondExp>
				</PSpec>
				<PSpec Name="H.263">
					<PSpecID>2685</PSpecID>
					<LName>H.263</LName>
					<SName>H.263</SName>
					<DescID>2670</DescID>
					<CondExp><![CDATA[(MLD8[1] & 0x7f) == 34]]></CondExp>
				</PSpec>
				<PSpec Name="GSM">
					<PSpecID>2687</PSpecID>
					<LName>GSM</LName>
					<SName>GSM</SName>
					<DescID>2670</DescID>
					<CondExp><![CDATA[(MLD8[1] & 0x7f) == 3]]></CondExp>
				</PSpec>
			</PSpec>
			<PSpec Name="RTCP" Sort="Last">
				<PSpecID>2671</PSpecID>
				<LName>Real-Time Transport Control Protocol</LName>
				<SName>RTCP</SName>
				<Desc>RTP&apos;s data transport is augmented by a control protocol (RTCP) to allow monitoring of the data delivery in a manner scalable to large multicast networks, and to provide minimal control and identification functionality.</Desc>
				<CondExp><![CDATA[ ((MLD8[0] & 0xc0) == 0x80) && (MLD8[1] >= 0xc8 && MLD8[1] <= 0xcc) ]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="PUP">
			<PSpecID>1250</PSpecID>
			<LName>(Xerox) Parc Universal Packet</LName>
			<SName>PUP</SName>
			<Desc>PUP is the fundamental unit of transfer in Xerox&apos;s XNS system, like IP datagrams on an IP internet. PUP may also be embedded in IP datagrams.</Desc>
			<Color>color_11</Color>
			<CondExp><![CDATA[ProtocolID == 12]]></CondExp>
		</PSpec>
		<PSpec Name="OSPF">
			<PSpecID>1200</PSpecID>
			<LName>Open Shortest Path First Routing Protocol</LName>
			<SName>OSPF</SName>
			<Desc>A collection of networks and/or gateways is deemed to be autonomous if it is managed by a single administration authority. OSPF is used as an interior gateway protocol inside of a single administration authority to learn about the networks and gateways in its authority domain. OSPF features type of service routing and load balancing that make it more flexible and powerful than RIP and other interior gateway protocols.</Desc>
			<Color>color_12</Color>
			<CondExp><![CDATA[ProtocolID == 89]]></CondExp>
			<PSpec Name="Hello">
				<PSpecID>1201</PSpecID>
				<LName>Open Shortest Path First Routing Protocol - Hello</LName>
				<SName>OSPF Hello</SName>
				<Desc>OSPF sends Hello messages on each link periodically to establish and test neighbor reachability.</Desc>
				<CondExp><![CDATA[MLD8[1] == 1]]></CondExp>
			</PSpec>
			<PSpec Name="Data Desc">
				<PSpecID>1202</PSpecID>
				<LName>Open Shortest Path 1st Routing Protocol - Database Description</LName>
				<SName>OSPF DDs</SName>
				<Desc>IP Gateways exchange OSPF Data Description messages to initialize their network topology database. In the exchange, one gateway serves as the master and the other is a slave. The slave acknowledges each Data Description message with a response.</Desc>
				<CondExp><![CDATA[MLD8[1] == 2]]></CondExp>
			</PSpec>
			<PSpec Name="Link State Req">
				<PSpecID>1203</PSpecID>
				<LName>Open Shortest Path First Routing Protocol - Link State Request</LName>
				<SName>OSPF LSR</SName>
				<Desc>If an IP gateway discovers that parts of its network topology data base are out of date, it will use the OSPF Link State Request message to ask a neighbor to supply updated information.</Desc>
				<CondExp><![CDATA[MLD8[1] == 3]]></CondExp>
			</PSpec>
			<PSpec Name="Link State Upd">
				<PSpecID>1204</PSpecID>
				<LName>Open Shortest Path First Routing Protocol - Link State Update</LName>
				<SName>OSPF LSU</SName>
				<Desc>IP gateways periodically broadcast the status of its links with the OSPF Link Status Update message. Each message consists of a list of link status advertisements which are the state of the router&apos;s interfaces and a list of its adjacencies on each link.</Desc>
				<CondExp><![CDATA[MLD8[1] == 4]]></CondExp>
			</PSpec>
			<PSpec Name="Link State Ack">
				<PSpecID>1205</PSpecID>
				<LName>Open Shortest Path 1st Routing Protocol - Link State Acknowledge</LName>
				<SName>OSPF LSA</SName>
				<Desc>In some OSPF scenarios, it is important that link status information must be transmit reliably and the Link State Acknowledgment packet is used to acknowledge one or more such link status information units (advertisements).</Desc>
				<CondExp><![CDATA[MLD8[1] == 5]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="VRRP">
			<NotChild Name="IPv6"/>
			<PSpecID>2210</PSpecID>
			<LName>Virtual Router Redundancy Protocol</LName>
			<SName>VRRP</SName>
			<Desc>The Virtual Router Redundancy Protocol (VRRP) is designed to eliminate the single point of failure inherent in the static default routed environment. VRRP specifies an election protocol that dynamically assigns responsibility for a virtual router to one of the VRRP routers on a LAN.</Desc>
			<Color>color_13</Color>
			<CondExp><![CDATA[ProtocolID == 112]]></CondExp>
		</PSpec>
		<PSpec Name="ESP">
			<PSpecID>2211</PSpecID>
			<LName>SIPP Encapsulated Security Payload</LName>
			<SName>ESP</SName>
			<Desc>The Encapsulating Security Payload (ESP) header is designed to provide a mix of security services in IPv4 and IPv6. ESP is used to provide confidentiality, data origin authentication, connectionless integrity, an anti-replay service (a form of partial sequence integrity), and limited traffic flow confidentiality.</Desc>
			<Color>color_14</Color>
			<CondExp><![CDATA[ProtocolID == 50]]></CondExp>
		</PSpec>
		<PSpec Name="AH">
			<PSpecID>2212</PSpecID>
			<LName>SIPP Authentication Header</LName>
			<SName>AH</SName>
			<Desc>The IP Authentication Header (AH) is used to provide connectionless integrity and data origin authentication for IP datagrams, and to provide protection against replays. AH may be applied alone, in combination with the IP Encapsulating Security Payload (ESP), or in a nested fashion through the use of tunnel mode.</Desc>
			<Color>color_15</Color>
			<CondExp><![CDATA[ProtocolID == 51]]></CondExp>
		</PSpec>
		<PSpec Name="GRE">
			<PSpecID>2213</PSpecID>
			<LName>Generic Routing Encapsulation</LName>
			<SName>GRE</SName>
			<Desc>Generic Routing Encapsulation (GRE) protocol allows an arbitrary network protocol to be transmitted over any other arbitrary network protocol by encapsulating the packets of the encapsulated protocol within GRE packets, and then transmitting the GRE packets over the base network protocol.</Desc>
			<Color>color_15</Color>
			<CondExp><![CDATA[ProtocolID == 47]]></CondExp>
		</PSpec>
		<PSpec Name="RSVP">
			<PSpecID>2214</PSpecID>
			<LName>Resource Reservation Protocol</LName>
			<SName>RSVP</SName>
			<Desc>RSVP provides receiver-initiated setup of resource reservations for multicast or unicast data flows, with good scaling and robustness properties.</Desc>
			<Color>color_15</Color>
			<CondExp><![CDATA[ProtocolID == 46]]></CondExp>
		</PSpec>
		<PSpec Name="PIM">
			<PSpecID>2215</PSpecID>
			<LName>Protocol Independant Multicast</LName>
			<SName>PIM</SName>
			<Desc>Protocol-Independent Multicast (PIM) is used to distribute multicast traffic mainly within an organization. To avoid multicast routing loops, a router only forwards a multicast packet if it is received on the interface it would use to send a unicast paket to the multicast source. If this Reverse Path Forwarding (RPF) check is fulfiled, the packet is replicated to all multicast enabled interfaces, except to the one it came from.  There are two PIM variants, dense mode and sparse mode. Sparse mode is the one that is normally used, because dense mode does not scale well. Sparse mode requires at least one rendezvous point (RP, a router with a few lines of extra configuration).</Desc>
			<Color>color_15</Color>
			<CondExp><![CDATA[ProtocolID == 103]]></CondExp>
		</PSpec>
		<PSpec Name="IPv6">
			<NotChild Name="IPv6"/>
			<PSpecID>8300</PSpecID>
			<LName>Internet Protocol Version 6</LName>
			<SName>IPv6</SName>
			<Desc>An IP datagram is the basic unit of information passed across the internet which provides the basis for connectionless, best-effort packet delivery service. The entire protocol stack which is built on top of IP is frequently called TCP/IP because TCP and IP are the two most fundamental protocols in the stack. As a non-proprietary standard, IP is the most prevalent networking protocol among heterogeneous computer systems.</Desc>
			<Color>color_13</Color>
			<CondExp><![CDATA[ProtocolID == 41]]></CondExp>
			<NextLayer>
				<Exp><![CDATA[     40     ]]></Exp>
			</NextLayer>
			<Definitions>
				<Define>
					<Name>ProtocolID</Name>
					<Value><![CDATA[PLD8[6]]]></Value>
				</Define>
				<Define>
					<Name>IPHdrLength</Name>
					<Value><![CDATA[40]]></Value>
				</Define>
				<Define>
					<Name>IPTotalLength</Name>
					<Value><![CDATA[40 + PLD16[4]]]></Value>
				</Define>
			</Definitions>
			<Link Name="IPv6 Children"/>
		</PSpec>
	</PSpec>
	<PSpec Name="Ethernet" Type="CommonTable">
		<PSpec Name="ARP">
			<PSpecID>500</PSpecID>
			<LName>Internet Protocol Address Resolution Protocol</LName>
			<SName>ARP</SName>
			<Desc>ARP packets are used to create a link between IP logical addresses and data link physical addresses (i.e. an Ethernet address). Given an IP logical address, ARP tries to discover the underlying data link physical address. Address resolution is a normal process of higher level protocols as they are established on different types of networking media.</Desc>
			<Color>color_5</Color>
			<ParentSpecific Parent="SNAP">
				<CondExp><![CDATA[ (PLD16[2] == 0x0300) && (PLD32[4] == 0x00000806 || PLD32[4] == 0x00f80806)  ]]></CondExp>
			</ParentSpecific>
			<ParentSpecific Parent="Ethernet Type 2">
				<CondExp><![CDATA[EthernetType == 0x0806]]></CondExp>
			</ParentSpecific>
			<PSpec Name="Request">
				<PSpecID>501</PSpecID>
				<LName>ARP Request</LName>
				<SName>ARP Request</SName>
				<Desc>IP hosts, gateways and routers keep a table of IP addresses with a corresponding data link hardware address. An ARP Request contains an IP address and requests someone to respond with the corresponding data link hardware address from their table. An IP host or another router or gateway may respond from their table of addresses. An ARP Request with no corresponding ARP Response means that the IP address given is deemed to be unreachable.</Desc>
				<CondExp><![CDATA[MLD16[6] == 0x0001]]></CondExp>
			</PSpec>
			<PSpec Name="Response">
				<PSpecID>502</PSpecID>
				<LName>ARP Response</LName>
				<SName>ARP Response</SName>
				<DescID>501</DescID>
				<CondExp><![CDATA[MLD16[6] == 0x0002]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="IP">
			<PSpecID>1000</PSpecID>
			<LName>Internet Protocol</LName>
			<SName>IP</SName>
			<DescID>8300</DescID>
			<Color>color_4</Color>
			<ParentSpecific Parent="SNAP">
				<CondExp><![CDATA[ (PLD16[2] == 0x0300) && (PLD32[4] == 0x00000800 || PLD32[4] == 0x00f80800)  ]]></CondExp>
			</ParentSpecific>
			<ParentSpecific Parent="Ethernet Type 2">
				<CondExp><![CDATA[EthernetType == 0x0800]]></CondExp>
			</ParentSpecific>
			<NextLayer>
				<Exp><![CDATA[     ((MLD8[0] & 0x0f) * 4)     ]]></Exp>
			</NextLayer>
			<Definitions>
				<Define>
					<Name>ProtocolID</Name>
					<Value><![CDATA[PLD8[9]]]></Value>
				</Define>
				<Define>
					<Name>IPHdrLength</Name>
					<Value><![CDATA[((PLD8[0] & 0x0f) * 4)]]></Value>
				</Define>
				<Define>
					<Name>IPTotalLength</Name>
					<Value><![CDATA[PLD16[2]]]></Value>
				</Define>
			</Definitions>
			<Link Name="IP Children"/>
			<PSpec Name="IP Fragment" Sort="First">
				<PSpecID>1001</PSpecID>
				<LName>Fragmented IP</LName>
				<SName>IP Fragment</SName>
				<CondExp><![CDATA[    (PLD16[6] & 0x1fff) != 0 ]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="IPX">
			<PSpecID>3750</PSpecID>
			<LName>NetWare Internet Protocol</LName>
			<SName>IPX</SName>
			<Desc>IPX is the lowest common protocol layer for implementing all of NetWare&apos;s higher level functions.</Desc>
			<Color>color_7</Color>
			<ParentSpecific Parent="SNAP">
				<CondExp><![CDATA[ PLD8[2] == 0x03 && PLD16[6] == 0x8137  ]]></CondExp>
			</ParentSpecific>
			<ParentSpecific Parent="Ethernet Type 2">
				<CondExp><![CDATA[EthernetType == 0x8137]]></CondExp>
			</ParentSpecific>
			<Link Name="IPX Children"/>
		</PSpec>
		<PSpec Name="MPLS">
			<PSpecID>30</PSpecID>
			<LName>Multi-Protocol Label Switching</LName>
			<SName>MPLS</SName>
			<Desc>In a Multi-Protocol Label Switching (MPLS) network, incoming packets are assigned a label by a label edge router (LER).  Packets are forwarded along a label switch path (LSP) where each label switch router (LSR) makes forwarding decisions based solely on the contents of the label.  At each hop, the LSR strips off the existing label and applies a new label which tells the next hop how to forward the packet.</Desc>
			<Color>color_3</Color>
			<ParentSpecific Parent="SNAP">
				<CondExp><![CDATA[ ((PLD16[6] == 0x8847) || (PLD16[6] == 0x8848)) && (PLD32[2] == 0x03000000) ]]></CondExp>
			</ParentSpecific>
			<ParentSpecific Parent="Ethernet Type 2">
				<CondExp><![CDATA[(EthernetType == 0x8847) || (EthernetType == 0x8848)]]></CondExp>
			</ParentSpecific>
		</PSpec>
		<PSpec Name="802.1x">
			<PSpecID>14000</PSpecID>
			<LName>IEEE 802.1x EAPOL</LName>
			<SName>802.1x</SName>
			<Desc>The 802.1X standard is designed to enhance the security of wireless local area networks (WLANs) that follow the IEEE 802.11 standard. 802.1X provides an authentication framework for wireless LANs, allowing a user to be authenticated by a central authority. The actual algorithm that is used to determine whether a user is authentic is left open and multiple algorithms are possible. 802.1X uses an existing protocol, the Extensible Authentication Protocol (EAP, RFC 2284), that works on Ethernet, token ring, or wireless LANs, for message exchange during the authentication process.</Desc>
			<Color>color_15</Color>
			<ParentSpecific Parent="SNAP">
				<CondExp><![CDATA[ PLD16[2] == 0x0300 && (PLD32[4] == 0x0000888e || PLD32[4] == 0x00f8888e) ]]></CondExp>
			</ParentSpecific>
			<ParentSpecific Parent="Ethernet Type 2">
				<CondExp><![CDATA[EthernetType == 0x888e]]></CondExp>
			</ParentSpecific>
			<PSpec Name="802.1x EAP-Packet">
				<PSpecID>14100</PSpecID>
				<LName>IEEE 802.1x EAP-Packet</LName>
				<SName>EAPOL EAP-Packet</SName>
				<Desc>The Code field is one octet (offset 0) and identifies the type of EAP packet.  There are four defined packet types: Request (1), Response (2), Success (3), and Failure(4).</Desc>
				<Color>color_15</Color>
				<CondExp><![CDATA[MLD16[0] == 0x0100]]></CondExp>
				<NextLayer>
					<Exp><![CDATA[     4    ]]></Exp>
				</NextLayer>
				<PSpec Name="EAP Request">
					<PSpecID>14110</PSpecID>
					<LName>EAP Request</LName>
					<SName>EAP Request</SName>
					<Desc>The EAP Request packet is sent by the authenticator to the peer.  Each Request has a type field which serves to indicate what is being requested.</Desc>
					<Color>color_15</Color>
					<CondExp><![CDATA[MLD8[0] == 0x01]]></CondExp>
				</PSpec>
				<PSpec Name="EAP Response">
					<PSpecID>14120</PSpecID>
					<LName>EAP Response</LName>
					<SName>EAP Response</SName>
					<Desc>The peer must send a Response packet in reply to a Request packet.  Responses must only be sent in reply to a received Request and never retransmitted on a timer.  The Identifier field of the Response must match that of the Request.</Desc>
					<Color>color_15</Color>
					<CondExp><![CDATA[MLD8[0] == 0x02]]></CondExp>
				</PSpec>
				<PSpec Name="EAP Success">
					<PSpecID>14130</PSpecID>
					<LName>EAP Success</LName>
					<SName>EAP Success</SName>
					<Desc>The Success packet is sent by the authenticator to the peer to  acknowledge successful authentication.  The authenticator must transmit an EAP packet with the Code field set to 3 (Success).</Desc>
					<Color>color_15</Color>
					<CondExp><![CDATA[MLD8[0] == 0x03]]></CondExp>
				</PSpec>
				<PSpec Name="EAP Failure">
					<PSpecID>14140</PSpecID>
					<LName>EAP Failure</LName>
					<SName>EAP Failure</SName>
					<Desc>If the authenticator cannot authenticate the peer (unacceptable Responses to one or more Requests) then the implementation must transmit an EAP packet with the Code field set to 4 (Failure).  An authenticator may wish to issue multiple Requests before sending a Failure response in order to allow for human typing mistakes.</Desc>
					<Color>color_15</Color>
					<CondExp><![CDATA[MLD8[0] == 0x04]]></CondExp>
				</PSpec>
			</PSpec>
			<PSpec Name="802.1x EAPOL-Start">
				<PSpecID>14200</PSpecID>
				<LName>IEEE 802.1x EAPOL-Start</LName>
				<SName>EAPOL-Start</SName>
				<Desc>A Supplicant PAE may initiate the authentication sequence by sending an EAPOL-Start frame.</Desc>
				<Color>color_15</Color>
				<CondExp><![CDATA[MLD16[0] == 0x0101]]></CondExp>
			</PSpec>
			<PSpec Name="802.1x EAPOL-Logoff">
				<PSpecID>14300</PSpecID>
				<LName>IEEE 802.1x EAPOL-Logoff</LName>
				<SName>EAPOL-Logoff</SName>
				<Desc>When a Supplicant wishes the Authenticator PAE to perform a logoff (i.e., to set the controlled Port state to unauthorized), the Supplicant PAE originates an EAPOL-Logoff message (7.5.4) to the Authenticator PAE.  As a result, the Authenticator PAE immediately places the controlled Port in the unauthorized state.</Desc>
				<Color>color_15</Color>
				<CondExp><![CDATA[MLD16[0] == 0x0102]]></CondExp>
			</PSpec>
			<PSpec Name="802.1x EAPOL-Key">
				<PSpecID>14400</PSpecID>
				<LName>IEEE 802.1x EAPOL-Key</LName>
				<SName>EAPOL-Key</SName>
				<Desc>EAPOL-Key frames are transmitted by the Authenticator PAE to the Supplicant PAE. These frames shall not be relayed onward by the Authenticator PAE to the Authentication Server.</Desc>
				<Color>color_15</Color>
				<CondExp><![CDATA[MLD16[0] == 0x0103]]></CondExp>
			</PSpec>
			<PSpec Name="802.1x EAPOL-Encapsulated-ASF-Alert">
				<PSpecID>14500</PSpecID>
				<LName>IEEE 802.1x EAPOL-Encapsulated-ASF-Alert</LName>
				<SName>EAPOL-Encapsulated-ASF-Alert</SName>
				<Desc>The Packet Type of EAPOL-Encapsulated-ASF-Alert provides a means in which alert messages can be encapsulated within an EAPOL frame and can be recognized as such by the protocol entities attached to the Uncontrolled Port.</Desc>
				<Color>color_15</Color>
				<CondExp><![CDATA[MLD16[0] == 0x0104]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="RARP">
			<PSpecID>510</PSpecID>
			<LName>Internet Protocol Reverse Address Resolution Protocol</LName>
			<SName>RARP</SName>
			<Desc>ARP is used to find the underlying data link physical address (i. e. an Ethernet address) given a logical (IP) address. RARP is used to discover the logical (IP) address when given the data link physical address. RARP is typically used by diskless workstations to establish an identity in the network&apos;s logical address space.</Desc>
			<Color>color_6</Color>
			<ParentSpecific Parent="SNAP">
				<CondExp><![CDATA[ PLD16[2] == 0x0300 && (PLD32[4] == 0x00008035 || PLD32[4] == 0x00f88035)  ]]></CondExp>
			</ParentSpecific>
			<ParentSpecific Parent="Ethernet Type 2">
				<CondExp><![CDATA[EthernetType == 0x8035]]></CondExp>
			</ParentSpecific>
			<PSpec Name="Request">
				<PSpecID>513</PSpecID>
				<LName>RARP Request</LName>
				<SName>RARP Request</SName>
				<Desc>Usually a machine&apos;s IP address is kept on secondary storage where it can be located at startup. In some situations, like diskless workstations, no such storage is available. Instead, these machines broadcast a RARP Request which contains their data link hardware address and asks some RARP server to give them an IP address. An IP RARP server may respond based upon a table of addresses that it keeps.</Desc>
				<CondExp><![CDATA[MLD16[6] == 0x0003]]></CondExp>
			</PSpec>
			<PSpec Name="Response">
				<PSpecID>514</PSpecID>
				<LName>RARP Response</LName>
				<SName>RARP Response</SName>
				<DescID>513</DescID>
				<CondExp><![CDATA[MLD16[6] == 0x0004]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="VLAN">
			<NotChild Name="VLAN"/>
			<PSpecID>40</PSpecID>
			<LName>802.1Q VLAN</LName>
			<SName>VLAN</SName>
			<Desc>802.1Q VLAN tags</Desc>
			<ParentSpecific Parent="SNAP">
				<CondExp><![CDATA[ (PLD16[2] == 0x0300) && (PLD32[4] == 0x00008100 || PLD32[4] == 0x00f88100)  ]]></CondExp>
			</ParentSpecific>
			<ParentSpecific Parent="Ethernet Type 2">
				<CondExp><![CDATA[EthernetType == 0x8100]]></CondExp>
			</ParentSpecific>
			<NextLayer>
				<Exp><![CDATA[     4     ]]></Exp>
			</NextLayer>
			<Definitions>
				<Define>
					<Name>EthernetType</Name>
					<Value><![CDATA[PLD16[2]]]></Value>
				</Define>
			</Definitions>
			<PSpec Name="Ethernet Type 2">
				<PSpecID>41</PSpecID>
				<LName>VLAN Ethernet Type 2</LName>
				<SName>VLAN EType2</SName>
				<DescID>2</DescID>
				<CondExp><![CDATA[EthernetType > 1500]]></CondExp>
				<Link Name="Ethernet Type 2 Children" Type="CommonTable"/>
			</PSpec>
			<PSpec Name="IEEE 802.3">
				<PSpecID>42</PSpecID>
				<LName>VLAN IEEE 802.3</LName>
				<SName>VLAN 802.3</SName>
				<DescID>1</DescID>
				<CondExp><![CDATA[EthernetType <= 1500]]></CondExp>
				<Link Name="802.2 LLC" Type="CommonTable"/>
			</PSpec>
		</PSpec>
		<PSpec Name="AARP">
			<PSpecID>450</PSpecID>
			<LName>AppleTalk Address Resolution Protocol</LName>
			<SName>AARP</SName>
			<Desc>AppleTalk Address Resolution Protocol. AARP packets are used to create a link between AppleTalk logical addresses and data link physical addresses (i.e. an Ethernet address). Address resolution is a normal process of higher level protocols as they are established on different types of networking media. These packets are now obsolete, normally being replaced by AARP Phase 2 packets.</Desc>
			<Color>color_3</Color>
			<ParentSpecific Parent="SNAP">
				<CondExp><![CDATA[ (PLD16[2] == 0x0300) && (PLD32[4] == 0x000080f3 || PLD32[4] == 0x00f880f3)  ]]></CondExp>
			</ParentSpecific>
			<ParentSpecific Parent="Ethernet Type 2">
				<CondExp><![CDATA[EthernetType == 0x80f3]]></CondExp>
			</ParentSpecific>
			<Link Name="AARP Children"/>
		</PSpec>
		<PSpec Name="DECnet">
			<PSpecID>5000</PSpecID>
			<LName>DECnet Digital Network Architecture (DNA)</LName>
			<SName>DECnet</SName>
			<Desc>DECnet is a layered architecture which implements a networking system widely available on Digital Equipment Corporation computers and on a few other types of systems. After the data link layer, DECnet breaks into a routing layer (node-to-node connectivity), followed by end communications (logical links), and then session control (process to process).</Desc>
			<Color>color_10</Color>
			<ParentSpecific Parent="SNAP">
				<CondExp><![CDATA[ PLD8[2] == 0x03 && (PLD24[3] == 0x08002b || (PLD24[3] == 0x000000 && ((PLD16[6] >= 0x6000 && PLD16[6] <= 0x600a) || (PLD16[6] >= 0x8038 && PLD16[6] <= 0x8042))))  ]]></CondExp>
			</ParentSpecific>
			<ParentSpecific Parent="Ethernet Type 2">
				<CondExp><![CDATA[PLD8[12] == 0x60]]></CondExp>
			</ParentSpecific>
			<PSpec Name="MOP Download">
				<PSpecID>5010</PSpecID>
				<LName>DECnet Maintenance Operations Protocol - Dump/Load Assist</LName>
				<SName>DEC MOPDL</SName>
				<Desc>DECnet MOP uses the Download protocol to Dump or Load remote and local systems or to command systems to dump or load themselves. Dump and load functions are used to back up and restore systems and may be used in the start up of remote systems.</Desc>
				<Color>color_12</Color>
				<CondExp><![CDATA[MLD8[-1] == 0x01]]></CondExp>
			</PSpec>
			<PSpec Name="MOP Remote Console">
				<PSpecID>5020</PSpecID>
				<LName>DECnet Maintenance Operations Protocol - Remote Console</LName>
				<SName>DEC MOPRC</SName>
				<Desc>DECnet MOP uses the Remote Console protocol to issue commands, poll data link counters and to request system information to and from remote DECnet systems.</Desc>
				<Color>color_12</Color>
				<CondExp><![CDATA[MLD8[-1] == 0x02]]></CondExp>
			</PSpec>
			<PSpec Name="Phase IV">
				<PSpecID>5030</PSpecID>
				<LName>DECnet Digital Network Architecture - Phase IV</LName>
				<SName>DEC Ph IV</SName>
				<Desc>DECnet Phase IV is the primary protocol used by DECnet to transmit data between nodes. It features a hierarchical routing layer which tracks data between areas and endnodes.</Desc>
				<Color>color_13</Color>
				<CondExp><![CDATA[MLD8[-1] == 0x03]]></CondExp>
				<PSpec Name="Ctl Init">
					<PSpecID>5031</PSpecID>
					<LName>DECnet Routing Layer Control Initialization</LName>
					<SName>DEC CtlInit</SName>
					<Desc>The Initialization Message is used to establish a node&apos;s routing layer type and various other service and system-dependent parameters.</Desc>
					<CondExp><![CDATA[((MLD8[2] & 0x0f) == 0x01) || (MLD8[2] == 0x81 && (MLD8[3] & 0x0f) == 0x01)]]></CondExp>
				</PSpec>
				<PSpec Name="Ctl Verify">
					<PSpecID>5032</PSpecID>
					<LName>DECnet Routing Layer Control Verification</LName>
					<SName>DEC CtlVerify</SName>
					<Desc>The Verification Message is used to return a function value as requested during a routing layer initialization sequence.</Desc>
					<CondExp><![CDATA[((MLD8[2] & 0x0f) == 0x03) || (MLD8[2] == 0x81 && (MLD8[3] & 0x0f) == 0x03)]]></CondExp>
				</PSpec>
				<PSpec Name="Ctl Hello">
					<PSpecID>5033</PSpecID>
					<LName>DECnet Routing Layer Control Hello And Test</LName>
					<SName>DEC CtlHello</SName>
					<Desc>The Hello and Test Message is used to test the connectivity of a circuit. Like echo and ping in other types of protocols, test data is transmitted as a test of the routing and link integrity.</Desc>
					<CondExp><![CDATA[((MLD8[2] & 0x0f) == 0x05) || (MLD8[2] == 0x81 && (MLD8[3] & 0x0f) == 0x05)]]></CondExp>
				</PSpec>
				<PSpec Name="Ctl L1 Routing">
					<PSpecID>5034</PSpecID>
					<LName>DECnet Routing Layer Control Level 1 Routing</LName>
					<SName>DEC L1Rtg</SName>
					<Desc>A Level 1 Routing Message contains information about links in a single DECnet area, their reachability and the cost to communicate on that link.</Desc>
					<CondExp><![CDATA[((MLD8[2] & 0x0f) == 0x07) || (MLD8[2] == 0x81 && (MLD8[3] & 0x0f) == 0x07)]]></CondExp>
				</PSpec>
				<PSpec Name="Ctl L2 Routing">
					<PSpecID>5035</PSpecID>
					<LName>DECnet Routing Layer Control Level 2 Routing</LName>
					<SName>DEC L2Rtg</SName>
					<Desc>A Level 2 Routing Message contains information about links between multiple DECnet areas, their reachability and the cost to communicate on that link.</Desc>
					<CondExp><![CDATA[((MLD8[2] & 0x0f) == 0x09) || (MLD8[2] == 0x81 && (MLD8[3] & 0x0f) == 0x09)]]></CondExp>
				</PSpec>
				<PSpec Name="Ctl Rtr Hello">
					<PSpecID>5036</PSpecID>
					<LName>DECnet Routing Layer Control Ethernet Router Hello</LName>
					<SName>DEC RtrHello</SName>
					<Desc>An Ethernet Router Hello Message provides information about the DECnet router including what level of router it is, the values of timers, maximum block size and a list of router states for the logical Ethernets on the corresponding physical Ethernet.</Desc>
					<CondExp><![CDATA[((MLD8[2] & 0x0f) == 0x0b) || (MLD8[2] == 0x81 && (MLD8[3] & 0x0f) == 0x0b)]]></CondExp>
				</PSpec>
				<PSpec Name="Ctl Enode Hello">
					<PSpecID>5037</PSpecID>
					<LName>DECnet Routing Layer Control Ethernet Endnode Hello</LName>
					<SName>DEC EnHello</SName>
					<Desc>An Ethernet Endnode Hello Message provides information about a DECnet endnode including the values of timers, maximum block size, designated router if any and some test data to test the circuit.</Desc>
					<CondExp><![CDATA[((MLD8[2] & 0x0f) == 0x0d) || (MLD8[2] == 0x81 && (MLD8[3] & 0x0f) == 0x0d)]]></CondExp>
				</PSpec>
				<PSpec Name="Data Short Format">
					<PSpecID>5038</PSpecID>
					<LName>DECnet Packet Route Short Data Format</LName>
					<SName>DEC SDFmt</SName>
					<Desc>The Short Data Packet Format is used to transmit data inside of an single DECnet area. It has minimal header information, but counts the number nodes that it visits before arriving at its destination.</Desc>
					<CondExp><![CDATA[((MLD8[2] & 0x07) == 0x02) || (MLD8[2] == 0x81 && (MLD8[3] & 0x07) == 0x02)]]></CondExp>
				</PSpec>
				<PSpec Name="Data Long Format">
					<PSpecID>5039</PSpecID>
					<LName>DECnet Packet Route Long Data Format</LName>
					<SName>DEC LDFmt</SName>
					<Desc>The Long Data Packet Format is used to transmit data between DECnet areas. It has header information which allows more efficient routing information.</Desc>
					<CondExp><![CDATA[((MLD8[2] & 0x07) == 0x06) || (MLD8[2] == 0x81 && (MLD8[3] & 0x07) == 0x06)]]></CondExp>
					<PSpec Name="NSP Data">
						<PSpecID>5040</PSpecID>
						<LName>DECnet Network Services Protocol - Data</LName>
						<SName>DEC NSPData</SName>
						<Desc>NSP provides logical link connections between two session control modules. NSP Data packets convey data between two ports in a logical link.</Desc>
						<CondExp><![CDATA[((MLD8[2] & 0x07) == 0x06 && (MLD8[23] & 0x0c) == 0x00) || (MLD8[2] == 0x81 && (MLD8[3] & 0x07) == 0x06 && (MLD8[24] & 0x0c) == 0x00)]]></CondExp>
					</PSpec>
					<PSpec Name="NSP Ack">
						<PSpecID>5041</PSpecID>
						<LName>DECnet Network Services Protocol - Acknowledge</LName>
						<SName>DEC NSPAck</SName>
						<Desc>NSP provides logical link connections between two session control modules. NSP Ack messages are used as part of a basic acknowledgment system to ensure packets are delivered in the requested order.</Desc>
						<CondExp><![CDATA[((MLD8[2] & 0x07) == 0x06 && (MLD8[23] & 0x0c) == 0x04) || (MLD8[2] == 0x81 && (MLD8[3] & 0x07) == 0x06 && (MLD8[24] & 0x0c) == 0x04)]]></CondExp>
					</PSpec>
					<PSpec Name="NSP Control">
						<PSpecID>5042</PSpecID>
						<LName>DECnet Network Services Protocol - Control</LName>
						<SName>DEC NSPCtl</SName>
						<Desc>NSP provides logical link connections between two session control modules. NSP Control messages are used set up, tear down and convey status about a logical link connection.</Desc>
						<CondExp><![CDATA[((MLD8[2] & 0x07) == 0x06 && (MLD8[23] & 0x0c) == 0x08) || (MLD8[2] == 0x81 && (MLD8[3] & 0x07) == 0x06 && (MLD8[24] & 0x0c) == 0x08)]]></CondExp>
						<PSpec Name="No Oper">
							<PSpecID>5043</PSpecID>
							<LName>DECnet Network Services Protocol - Control:No Operation</LName>
							<SName>DEC CtlNop</SName>
							<Desc>NSP Control messages of the No Operation type are used to show that the logical link is still active at both ends.</Desc>
							<CondExp><![CDATA[((MLD8[23] & 0xf0) == 0x00) || (MLD8[2] == 0x81 && (MLD8[24] & 0xf0) == 0x00)]]></CondExp>
						</PSpec>
						<PSpec Name="Conn Init">
							<PSpecID>5044</PSpecID>
							<LName>DECnet Network Services Protocol - Control:Connect Initiate</LName>
							<SName>DEC CInit</SName>
							<Desc>NSP Control messages of the Connect Initiate type are used to request the set up of a logical link connection in NSP.</Desc>
							<CondExp><![CDATA[((MLD8[23] & 0xf0) == 0x10) || (MLD8[2] == 0x81 && (MLD8[24] & 0xf0) == 0x10)]]></CondExp>
						</PSpec>
						<PSpec Name="Conn Confirm">
							<PSpecID>5045</PSpecID>
							<LName>DECnet Network Services Protocol - Control:Connect Confirm</LName>
							<SName>DEC CConf</SName>
							<Desc>NSP Control messages of the Connect Confirm type are used to acknowledge that a logical link connection in NSP has been set up.</Desc>
							<CondExp><![CDATA[((MLD8[23] & 0xf0) == 0x20) || (MLD8[2] == 0x81 && (MLD8[24] & 0xf0) == 0x20)]]></CondExp>
						</PSpec>
						<PSpec Name="Disc Init">
							<PSpecID>5046</PSpecID>
							<LName>DECnet Network Services Protocol - Control:Disconnect Initiate</LName>
							<SName>DEC DInit</SName>
							<Desc>NSP Control messages of the Disconnect Initiate type are used to announce that a logical link will be closed at one end.</Desc>
							<CondExp><![CDATA[((MLD8[23] & 0xf0) == 0x30) || (MLD8[2] == 0x81 && (MLD8[24] & 0xf0) == 0x30)]]></CondExp>
						</PSpec>
						<PSpec Name="Disc Confirm">
							<PSpecID>5047</PSpecID>
							<LName>DECnet Network Services Protocol - Control:Disconnect Confirm</LName>
							<SName>DEC DConf</SName>
							<Desc>NSP Control messages of the Disconnect Confirm type are used to acknowledge that a logical link connection in NSP has been closed.</Desc>
							<CondExp><![CDATA[((MLD8[23] & 0xf0) == 0x40) || (MLD8[2] == 0x81 && (MLD8[24] & 0xf0) == 0x40)]]></CondExp>
						</PSpec>
						<PSpec Name="ReXmit Conn Init">
							<PSpecID>5048</PSpecID>
							<LName>DECnet Network Services Proto - Ctl:Retransmit Connect Initiate</LName>
							<SName>DEC RXCI</SName>
							<Desc>NSP Control messages of the Retransmit Connect Initiate type are used to request the set up of a logical link connection in NSP. A previous attempt to set up the logical link has failed, probably due to insufficient link resources at one end of the connection.</Desc>
							<CondExp><![CDATA[((MLD8[23] & 0xf0) == 0x60) || (MLD8[2] == 0x81 && (MLD8[24] & 0xf0) == 0x60)]]></CondExp>
						</PSpec>
					</PSpec>
				</PSpec>
			</PSpec>
			<PSpec Name="LAT">
				<PSpecID>5070</PSpecID>
				<LName>DECnet Local Area Transport Protocol</LName>
				<SName>DEC LAT</SName>
				<Desc>DECnet LAT is used for virtual terminal applications in a DECnet environment. Using a client-server architecture, a terminal server requests a link from a host and data may be multiplexed from multiple sessions.</Desc>
				<Color>color_14</Color>
				<CondExp><![CDATA[MLD8[-1] == 0x04]]></CondExp>
				<PSpec Name="Run">
					<PSpecID>5071</PSpecID>
					<LName>DECnet LAT - Run</LName>
					<SName>LAT Run</SName>
					<Desc>The Run message is a virtual circuit layer message that transmits state and slot information between systems. LAT data is sent in Run messages.</Desc>
					<CondExp><![CDATA[(MLD8[0] & 0xfc) == 0x00]]></CondExp>
				</PSpec>
				<PSpec Name="Connect">
					<PSpecID>5072</PSpecID>
					<LName>DECnet LAT - Connect</LName>
					<SName>LAT Conn</SName>
					<Desc>The Connect message is a virtual circuit layer message used to establish new virtual circuits.</Desc>
					<CondExp><![CDATA[(MLD8[0] & 0xfc) == 0x04]]></CondExp>
				</PSpec>
				<PSpec Name="Disconnect">
					<PSpecID>5073</PSpecID>
					<LName>DECnet LAT - Disconnect</LName>
					<SName>LAT Disc</SName>
					<Desc>The Disconnect message is a virtual circuit layer message used to end virtual circuit session. It may be initiated when there are multiple errors detected.</Desc>
					<CondExp><![CDATA[(MLD8[0] & 0xfc) == 0x08]]></CondExp>
				</PSpec>
				<PSpec Name="Service">
					<PSpecID>5074</PSpecID>
					<LName>DECnet LAT - Service</LName>
					<SName>LAT Svc</SName>
					<Desc>The Service message is part of the LAT directory service. Slaves periodically multicast Service Announcement messages to advertise service and ratings. Masters use Service Announcement messages to update a the list of services and ratings.</Desc>
					<CondExp><![CDATA[(MLD8[0] & 0xfc) == 0x28]]></CondExp>
				</PSpec>
			</PSpec>
			<PSpec Name="Diagnostics">
				<PSpecID>5080</PSpecID>
				<LName>DECnet Diagnostic Protocol</LName>
				<SName>DEC Diag</SName>
				<Desc>The DECnet Diagnostic Protocol is used to test data link integrity.</Desc>
				<Color>color_15</Color>
				<CondExp><![CDATA[MLD8[-1] == 0x05]]></CondExp>
			</PSpec>
			<PSpec Name="Customer Use">
				<PSpecID>5085</PSpecID>
				<LName>DECnet Customer Use</LName>
				<SName>DEC Cust</SName>
				<Desc>The DECnet Customer Use Protocol is used by specific applications in a DECnet environment.</Desc>
				<Color>color_1</Color>
				<CondExp><![CDATA[MLD8[-1] == 0x06]]></CondExp>
			</PSpec>
			<PSpec Name="LAVC">
				<PSpecID>5088</PSpecID>
				<LName>DECnet Local Area VAX Cluster</LName>
				<SName>DEC LAVC</SName>
				<Desc>DECnet LAVC is an addition to the Phase IV protocol which takes into account that individual workstations have significant processing power and therefore routing capabilities. A local area DECnet network comprised of such DECnet nodes can take advantage of certain routing efficiencies.</Desc>
				<Color>color_2</Color>
				<CondExp><![CDATA[MLD8[-1] == 0x07]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="VINES-Echo">
			<PSpecID>4501</PSpecID>
			<LName>Banyan VINES Echo Protocol</LName>
			<SName>VINES Echo</SName>
			<Desc>The VINES Echo Protocol is used for diagnostic purposes on all LANs that support VINES Internet. This protocol does not make use of a datagram layer, so packets usually consist of only data.</Desc>
			<Color>color_1</Color>
			<ParentSpecific Parent="SNAP">
				<CondExp><![CDATA[ PLD8[2] == 0x03 && PLD16[6] == 0x0baf  ]]></CondExp>
			</ParentSpecific>
			<ParentSpecific Parent="Ethernet Type 2">
				<CondExp><![CDATA[(EthernetType == 0x0baf) || (EthernetType == 0x80c5)]]></CondExp>
			</ParentSpecific>
		</PSpec>
		<PSpec Name="XNS">
			<PSpecID>4000</PSpecID>
			<LName>Xerox Network Systems Protocol</LName>
			<SName>XNS</SName>
			<Desc>XNS was one of the first Ethernet protocols and is the model for many subsequent protocols. XNS is comprised of its own internet packets or datagrams. At the next level, these packets are fed into a protocol layer which sequences the packets and takes care of retransmission and flow control issues.</Desc>
			<Color>color_13</Color>
			<ParentSpecific Parent="SNAP">
				<CondExp><![CDATA[ (PLD16[2] == 0x0300) && (PLD32[4] == 0x00000600 || PLD32[4] == 0x00f80600) ]]></CondExp>
			</ParentSpecific>
			<ParentSpecific Parent="Ethernet Type 2">
				<CondExp><![CDATA[EthernetType == 0x0600]]></CondExp>
			</ParentSpecific>
			<Link Name="XNS Children"/>
		</PSpec>
		<PSpec Name="IPv6">
			<PSpecID>8300</PSpecID>
			<Color>color_13</Color>
			<ParentSpecific Parent="Ethernet Type 2">
				<CondExp><![CDATA[EthernetType == 0x86dd]]></CondExp>
			</ParentSpecific>
			<ParentSpecific Parent="SNAP">
				<CondExp><![CDATA[ (PLD16[2] == 0x0300) && (PLD32[4] == 0x000086dd || PLD32[4] == 0x00f886dd)  ]]></CondExp>
			</ParentSpecific>
			<NextLayer>
				<Exp><![CDATA[     40     ]]></Exp>
			</NextLayer>
			<Definitions>
				<Define>
					<Name>ProtocolID</Name>
					<Value><![CDATA[PLD8[6]]]></Value>
				</Define>
				<Define>
					<Name>IPHdrLength</Name>
					<Value><![CDATA[40]]></Value>
				</Define>
				<Define>
					<Name>IPTotalLength</Name>
					<Value><![CDATA[40 + PLD16[4]]]></Value>
				</Define>
			</Definitions>
			<Link Name="IPv6 Children"/>
		</PSpec>
	</PSpec>
	<PSpec Name="802.2 LLC" Type="CommonTable">
		<PSpec Name="IPX">
			<PSpecID>3750</PSpecID>
			<LName>NetWare Internet Protocol</LName>
			<SName>IPX</SName>
			<Color>color_7</Color>
			<CondExp><![CDATA[MLD16[0] == 0xffff]]></CondExp>
			<Link Name="IPX Children"/>
		</PSpec>
		<PSpec Name="SNAP">
			<PSpecID>9</PSpecID>
			<LName>SNAP</LName>
			<SName>SNAP</SName>
			<Desc>IEEE 802.2 LLC SNAP Layer</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[MLD16[0] == 0xaaaa]]></CondExp>
			<NextLayer>
				<Exp><![CDATA[    8 ]]></Exp>
			</NextLayer>
			<Link Name="Ethernet"/>
			<PSpec Name="AppleTalk">
				<PSpecID>7100</PSpecID>
				<LName>AppleTalk Phase 2</LName>
				<SName>AppleTalk Ph2</SName>
				<Desc>The AppleTalk protocol is used for communication between Apple products and a few other types of systems. Phase 2 was adopted to correct problems in addressing which arose in Phase 1 and also to comply with the IEEE 802.2 and 802.3 standards.</Desc>
				<Color>color_2</Color>
				<CondExp><![CDATA[ PLD16[6] == 0x809b && (PLD32[2] == 0x03000000 || PLD32[2] == 0x03080007 || PLD32[2] == 0x030000f8)  ]]></CondExp>
				<NextLayer>
					<Exp><![CDATA[     13     ]]></Exp>
				</NextLayer>
				<Link Name="AppleTalk DDP"/>
			</PSpec>
			<PSpec Name="VINES-IP">
				<PSpecID>4700</PSpecID>
				<LName>Banyan VINES Internet Protocol</LName>
				<SName>VINES IP</SName>
				<DescID>4500</DescID>
				<Color>color_15</Color>
				<CondExp><![CDATA[ PLD8[2] == 0x03 && PLD16[6] == 0x0bad  ]]></CondExp>
				<Link Name="VINES Children"/>
			</PSpec>
			<PSpec Name="Cisco Discovery">
				<PSpecID>13</PSpecID>
				<LName>Cisco Discovery Protocol</LName>
				<SName>Discovery</SName>
				<Desc>The Cisco Discovery Protocol is used by Cisco routers to communicate configuration information as well as software and firmware version numbers.</Desc>
				<Color>color_2</Color>
				<CondExp><![CDATA[ PLD8[2] == 0x03 && PLD24[5] == 0x0c2000  ]]></CondExp>
			</PSpec>
			<PSpec Name="CGMP">
				<PSpecID>15</PSpecID>
				<LName>Cisco Group Management Protocol</LName>
				<SName>CGMP</SName>
				<Desc>Cisco Group Management Protocol (CGMP) is a protocol used on routers connected to Cisco Catalyst switches to perform tasks similar to those performed by IGMP. CGMP is necessary because the Catalyst switch cannot tell the difference between IP multicast data packets and IGMP Report messages, which are both MAC-level addressed to the same group address.</Desc>
				<Color>color_3</Color>
				<CondExp><![CDATA[ PLD16[6] == 0x2001 ]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="LSAP">
			<PSpecID>10</PSpecID>
			<LName>LSAP</LName>
			<SName>LSAP</SName>
			<Desc>IEEE 802.2 LLC SAP Layer</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[ PLD16[0] != 0xaaaa ]]></CondExp>
			<NextLayer>
				<Exp><![CDATA[    (((MLD8[2] & 0x03) == 0x03) ? 0x03 : 0x04)     ]]></Exp>
			</NextLayer>
			<PSpec Name="SNA">
				<PSpecID>1600</PSpecID>
				<LName>System Network Architecture</LName>
				<SName>SNA</SName>
				<Desc>Developed in the 1970s by IBM, SNA has an overall structure that parallels the OSI reference model. A mainframe running Advanced Communication Facility/Virtual Telecommunication Access Method (ACF/VTAM) serves as the hub of an SNA network. ACF/VTAM is responsible for establishing all sessions and for activating and deactivating resources. In this environment, resources are explicitly predefined, thereby eliminating the requirement for broadcast traffic and minimizing header overhead.</Desc>
				<CondExp><![CDATA[(PLD8[0] == 0x04) || (PLD8[1] == 0x04) || (PLD8[0] == 0x05) || (PLD8[1] == 0x05)]]></CondExp>
			</PSpec>
			<PSpec Name="802.1 Spanning Tree">
				<PSpecID>12</PSpecID>
				<LName>IEEE 802.1 Bridge Spanning Tree</LName>
				<SName>802.1</SName>
				<Desc>802.1 was created in order that bridges may dynamically discover a subset of the network topology that is loop-free (a tree) and yet has enough connectivity so that where physically possible, there is a path between every pair of LANs (i. e. the tree is spanning). In 802.1, bridges transmit special messages to each other that allow them to calculate a spanning tree and then use that path for routing purposes.</Desc>
				<Color>color_15</Color>
				<CondExp><![CDATA[PLD16[0] == 0x4242]]></CondExp>
			</PSpec>
			<PSpec Name="IPX">
				<PSpecID>3750</PSpecID>
				<LName>NetWare Internet Protocol</LName>
				<SName>IPX</SName>
				<Color>color_8</Color>
				<CondExp><![CDATA[(PLD8[0] == 0xe0) || (PLD8[1] == 0xe0)]]></CondExp>
				<Link Name="IPX Children"/>
			</PSpec>
			<PSpec Name="NetBEUI/NetBIOS">
				<PSpecID>6000</PSpecID>
				<LName>NetBIOS Extended User Interface</LName>
				<SName>NetBEUI</SName>
				<Desc>NetBIOS Extended User Interface - Network Basic Input/Output System. NetBIOS was originally defined by MicroSoft as part of their networking strategy known as Open Net and LAN Manager or LANMAN. NetBEUI extended and formalized this definition to incorporate the current IEEE 802.3 standards. NetBIOS is incorporated into other protocol stacks, but typically has a number of changes as part of those variants.</Desc>
				<Color>color_11</Color>
				<CondExp><![CDATA[(PLD8[0] == 0xf0) || (PLD8[1] == 0xf0)]]></CondExp>
				<PSpec Name="Add Group Name Query">
					<PSpecID>6001</PSpecID>
					<LName>NetBIOS Add Group Name Query</LName>
					<SName>NB AGNQ</SName>
					<Desc>NetBIOS Name Management Command Frame used to check for duplicate group names on the network.</Desc>
					<Color>color_3</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef00  ]]></CondExp>
				</PSpec>
				<PSpec Name="Add Name Query">
					<PSpecID>6002</PSpecID>
					<LName>NetBIOS Add Name Query</LName>
					<SName>NB AdNQ</SName>
					<Desc>NetBIOS Name Management Command Frame used to check for duplicate names on the network</Desc>
					<Color>color_4</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef01  ]]></CondExp>
				</PSpec>
				<PSpec Name="Name In Conflict">
					<PSpecID>6003</PSpecID>
					<LName>NetBIOS Name In Conflict</LName>
					<SName>NB NamIC</SName>
					<Desc>NetBIOS Name Management Command Frame used to report that duplicate names have been detected on the network.</Desc>
					<Color>color_5</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef02  ]]></CondExp>
				</PSpec>
				<PSpec Name="Status Query">
					<PSpecID>6004</PSpecID>
					<LName>NetBIOS Status Query</LName>
					<SName>NB StatQ</SName>
					<Desc>NetBIOS Frame Command used to request remote node status</Desc>
					<Color>color_6</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef03  ]]></CondExp>
				</PSpec>
				<PSpec Name="Term Trace (Remote)">
					<PSpecID>6005</PSpecID>
					<LName>NetBIOS Terminate Trace (Remote Only)</LName>
					<SName>NB TTRO</SName>
					<Desc>NetBIOS Frame Command used to terminate traces at remote nodes.</Desc>
					<Color>color_7</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef07  ]]></CondExp>
				</PSpec>
				<PSpec Name="Datagram">
					<PSpecID>6006</PSpecID>
					<LName>NetBIOS Datagram</LName>
					<SName>NB Datagram</SName>
					<Desc>NetBIOS Session Frame Command for an application-generated datagram.</Desc>
					<Color>color_8</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef08  ]]></CondExp>
					<NextLayer>
						<Exp><![CDATA[     44     ]]></Exp>
					</NextLayer>
					<Link Name="NetBIOS SMB"/>
				</PSpec>
				<PSpec Name="Datagram Bcast">
					<PSpecID>6007</PSpecID>
					<LName>NetBIOS Datagram Broadcast</LName>
					<SName>NB Dgram Bcast</SName>
					<Desc>NetBIOS Session Frame Command for an application-generated broadcast datagram.</Desc>
					<Color>color_10</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef09  ]]></CondExp>
				</PSpec>
				<PSpec Name="Name Query">
					<PSpecID>6008</PSpecID>
					<LName>NetBIOS Name Query</LName>
					<SName>NB Name Query</SName>
					<Desc>NetBIOS Frame Command used to request to locate a name on the network.</Desc>
					<Color>color_15</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef0a  ]]></CondExp>
				</PSpec>
				<PSpec Name="Add Name Rsp">
					<PSpecID>6009</PSpecID>
					<LName>NetBIOS Add Name Response</LName>
					<SName>NB Add Name Rsp</SName>
					<Desc>NetBIOS Name Management Command Frame that provides a negative response when user attempts to add a duplicate name.</Desc>
					<Color>color_12</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef0d  ]]></CondExp>
				</PSpec>
				<PSpec Name="Name Recognized">
					<PSpecID>6010</PSpecID>
					<LName>NetBIOS Name Recognized</LName>
					<SName>NB Name Recog</SName>
					<Desc>NetBIOS Frame used to respond to a Name Query.</Desc>
					<Color>color_13</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef0e  ]]></CondExp>
				</PSpec>
				<PSpec Name="Status Rsp">
					<PSpecID>6011</PSpecID>
					<LName>NetBIOS Status Response</LName>
					<SName>NB Status Rsp</SName>
					<Desc>NetBIOS Frame Command used to provide remote node status information. Response to a Status Query.</Desc>
					<Color>color_14</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef0f  ]]></CondExp>
				</PSpec>
				<PSpec Name="Term Trace (Local)">
					<PSpecID>6012</PSpecID>
					<LName>NetBIOS Terminate Trace (Local and Remote)</LName>
					<SName>NB TTLR</SName>
					<Desc>NetBIOS Frame Command used to terminate traces at local nodes.</Desc>
					<Color>color_7</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef13  ]]></CondExp>
				</PSpec>
				<PSpec Name="Data Ack">
					<PSpecID>6013</PSpecID>
					<LName>NetBIOS Data Ack</LName>
					<SName>NB Data Ack</SName>
					<Desc>NetBIOS Frame used to acknowledge a DATA ONLY LAST message.</Desc>
					<Color>color_1</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef14  ]]></CondExp>
				</PSpec>
				<PSpec Name="Data 1st Middle">
					<PSpecID>6014</PSpecID>
					<LName>NetBIOS Data 1st Middle</LName>
					<SName>NB Data 1st Middle</SName>
					<Desc>NetBIOS command to transfer a session data message - first or middle frame.</Desc>
					<Color>color_2</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef15  ]]></CondExp>
				</PSpec>
				<PSpec Name="Data Only Last">
					<PSpecID>6015</PSpecID>
					<LName>NetBIOS Data Only Last</LName>
					<SName>NB Data Only Last</SName>
					<Desc>NetBIOS command to transfer a session data message - only or last frame.</Desc>
					<Color>color_3</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef16  ]]></CondExp>
					<NextLayer>
						<Exp><![CDATA[     14    ]]></Exp>
					</NextLayer>
					<Link Name="NetBIOS SMB"/>
				</PSpec>
				<PSpec Name="Session Confirm">
					<PSpecID>6016</PSpecID>
					<LName>NetBIOS Session Confirm</LName>
					<SName>NB Sess Conf</SName>
					<Desc>NetBIOS Frame used to acknowledge a SESSION_INITIALIZE message.</Desc>
					<Color>color_4</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef17  ]]></CondExp>
				</PSpec>
				<PSpec Name="Session End">
					<PSpecID>6017</PSpecID>
					<LName>NetBIOS Session End</LName>
					<SName>NB Sess End</SName>
					<Desc>NetBIOS Frame used to terminate a session.</Desc>
					<Color>color_5</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef18  ]]></CondExp>
				</PSpec>
				<PSpec Name="Session Initialize">
					<PSpecID>6018</PSpecID>
					<LName>NetBIOS Session Initialize</LName>
					<SName>NB Sess Init</SName>
					<Desc>NetBIOS Frame used to verify that a session has been set-up.</Desc>
					<Color>color_6</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef19  ]]></CondExp>
				</PSpec>
				<PSpec Name="No Receive">
					<PSpecID>6019</PSpecID>
					<LName>NetBIOS No Receive</LName>
					<SName>NB No Rcv</SName>
					<Desc>NetBIOS Session Frame no receive command is used to hold received data.</Desc>
					<Color>color_7</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef1a  ]]></CondExp>
				</PSpec>
				<PSpec Name="Receive Outstanding">
					<PSpecID>6020</PSpecID>
					<LName>NetBIOS Receive Outstanding</LName>
					<SName>NB Rcv Out</SName>
					<Desc>NetBIOS Session Frame Command to retransmit last data - receive command up.</Desc>
					<Color>color_8</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef1b  ]]></CondExp>
				</PSpec>
				<PSpec Name="Receive Continue">
					<PSpecID>6021</PSpecID>
					<LName>NetBIOS Receive Continue</LName>
					<SName>NB Rcv Cont</SName>
					<Desc>NetBIOS Session Frame Command that indicates that a receive is outstanding.</Desc>
					<Color>color_10</Color>
					<CondExp><![CDATA[  MLD24[2] == 0xffef1c  ]]></CondExp>
				</PSpec>
				<PSpec Name="Session Alive">
					<PSpecID>6022</PSpecID>
					<LName>NetBIOS Session Alive</LName>
					<SName>NB Sess Alive</SName>
					<Desc>NetBIOS Frame used to verify that a session is still alive.</Desc>
					<CondExp><![CDATA[  MLD24[2] == 0xffef1f  ]]></CondExp>
				</PSpec>
			</PSpec>
			<PSpec Name="OSI">
				<PSpecID>8000</PSpecID>
				<LName>Open Systems Interconnection</LName>
				<SName>OSI</SName>
				<Desc>A protocol suite, parts of which are used in various protocol implementations. DECnet Phase IV and V, for instance, use the OSI network layer packet format as well as the File Access, Transfer, and Management (FTAM) standards for data access. No protocol incorporates all of the pieces that comprise the OSI suite.</Desc>
				<Color>color_12</Color>
				<CondExp><![CDATA[(PLD8[0] == 0xfe) || (PLD8[1] == 0xfe)]]></CondExp>
				<PSpec Name="CLNP">
					<PSpecID>8100</PSpecID>
					<LName>OSI Connectionless Mode Network Services Protocol</LName>
					<SName>CLNP</SName>
					<Desc>There are two models for how a network should look to endnodes. One model is known as connectionless. In this model, an endnode transmits packets on the network, together with the address to which the data should be delivered. The network does its best to deliver the packets, but with some probability of the data&apos;s getting lost, duplicated, or damaged., Also, each data item (packet) is independently routed, and the network does not guarantee that the packets will be kept in order, meaning that if packet 1 is sent, followed by packet 2, packet 2 might be delivered before packet 1.</Desc>
					<Color>color_9</Color>
					<CondExp><![CDATA[MLD8[0] == 0x81]]></CondExp>
					<PSpec Name="TARP">
						<PSpecID>8111</PSpecID>
						<LName>CLNP TID Address Resolution Protocol</LName>
						<SName>CLNP TARP</SName>
						<Desc>The TARP Protocol is used on the NE-NE interface when there is a need to translate the TID of TL1 messages to the CLNP address (NSAP) of an NE.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && MLD8[50] == 0xaf]]></CondExp>
						<PSpec Name="L1 Request">
							<PSpecID>8112</PSpecID>
							<LName>CLNP Level 1 TARP Request</LName>
							<SName>CLNP TARP L1Req</SName>
							<DescID>8111</DescID>
							<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && MLD8[50] == 0xaf && MLD8[65] == 0x01]]></CondExp>
						</PSpec>
						<PSpec Name="L2 Request">
							<PSpecID>8113</PSpecID>
							<LName>CLNP Level 2 TARP Request</LName>
							<SName>CLNP TARP L2Req</SName>
							<DescID>8111</DescID>
							<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && MLD8[50] == 0xaf && MLD8[65] == 0x02]]></CondExp>
						</PSpec>
						<PSpec Name="Response">
							<PSpecID>8114</PSpecID>
							<LName>CLNP TARP Response</LName>
							<SName>CLNP TARP Rsp</SName>
							<DescID>8111</DescID>
							<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && MLD8[50] == 0xaf && MLD8[65] == 0x03]]></CondExp>
						</PSpec>
						<PSpec Name="Addr Change">
							<PSpecID>8115</PSpecID>
							<LName>CLNP TARP Address Change</LName>
							<SName>CLNP TARP AddrCh</SName>
							<DescID>8111</DescID>
							<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && MLD8[50] == 0xaf && MLD8[65] == 0x04]]></CondExp>
						</PSpec>
						<PSpec Name="Req TID">
							<PSpecID>8116</PSpecID>
							<LName>CLNP TARP Request TID</LName>
							<SName>CLNP TARP ReqTID</SName>
							<DescID>8111</DescID>
							<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && MLD8[50] == 0xaf && MLD8[65] == 0x05]]></CondExp>
						</PSpec>
					</PSpec>
					<PSpec Name="Exp Data">
						<PSpecID>8101</PSpecID>
						<LName>CLNP Expedited Data</LName>
						<SName>CLNP ExpData</SName>
						<Desc>There are two models for how a network should look to endnodes. One model is known as connectionless. In this model, an endnode transmits packets on the network, together with the address to which the data should be delivered. The network does its best to deliver the packets, but with some probability of the data&apos;s getting lost, duplicated, or damaged., Also, each data item (packet) is independently routed, and the network does not guarantee that the packets will be kept in order, meaning that if packet 1 is sent, followed by packet 2, packet 2 might be delivered before packet 1.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && (MLD8[61] & 0xf0) == 0x10]]></CondExp>
					</PSpec>
					<PSpec Name="Exp Data Ack">
						<PSpecID>8102</PSpecID>
						<LName>CLNP Expedited Data Acknowledge</LName>
						<SName>CLNP ExpDataAck</SName>
						<Desc>There are two models for how a network should look to endnodes. One model is known as connectionless. In this model, an endnode transmits packets on the network, together with the address to which the data should be delivered. The network does its best to deliver the packets, but with some probability of the data&apos;s getting lost, duplicated, or damaged., Also, each data item (packet) is independently routed, and the network does not guarantee that the packets will be kept in order, meaning that if packet 1 is sent, followed by packet 2, packet 2 might be delivered before packet 1.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && (MLD8[61] & 0xf0) == 0x20]]></CondExp>
					</PSpec>
					<PSpec Name="Reject">
						<PSpecID>8103</PSpecID>
						<LName>CLNP Reject</LName>
						<SName>CLNP Reject</SName>
						<Desc>There are two models for how a network should look to endnodes. One model is known as connectionless. In this model, an endnode transmits packets on the network, together with the address to which the data should be delivered. The network does its best to deliver the packets, but with some probability of the data&apos;s getting lost, duplicated, or damaged., Also, each data item (packet) is independently routed, and the network does not guarantee that the packets will be kept in order, meaning that if packet 1 is sent, followed by packet 2, packet 2 might be delivered before packet 1.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && (MLD8[61] & 0xf0) == 0x50]]></CondExp>
					</PSpec>
					<PSpec Name="Data Ack">
						<PSpecID>8104</PSpecID>
						<LName>CLNP Data Acknowledge</LName>
						<SName>CLNP Data Ack</SName>
						<Desc>There are two models for how a network should look to endnodes. One model is known as connectionless. In this model, an endnode transmits packets on the network, together with the address to which the data should be delivered. The network does its best to deliver the packets, but with some probability of the data&apos;s getting lost, duplicated, or damaged., Also, each data item (packet) is independently routed, and the network does not guarantee that the packets will be kept in order, meaning that if packet 1 is sent, followed by packet 2, packet 2 might be delivered before packet 1.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && (MLD8[61] & 0xf0) == 0x60]]></CondExp>
					</PSpec>
					<PSpec Name="TPDU Err">
						<PSpecID>8105</PSpecID>
						<LName>CLNP Transport Protocol Data Unit Error Protocol</LName>
						<SName>CLNP TPDU Err</SName>
						<Desc>In CLNP an error report has the same format as a data packet, except that the type field (the bottom 5 bits of the fifth octet) is equal to 1, indicating that it is an error report, rather than 28, which is a data packet. If a router is unable to forward a packet, it will return the packet to the source address if the source device has set the E/R (error report requested) flag in that packet&apos;s header.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && (MLD8[61] & 0xf0) == 0x70]]></CondExp>
					</PSpec>
					<PSpec Name="Disconn Req">
						<PSpecID>8106</PSpecID>
						<LName>CLNP Disconnect Request</LName>
						<SName>CLNP Disconn Req</SName>
						<Desc>There are two models for how a network should look to endnodes. One model is known as connectionless. In this model, an endnode transmits packets on the network, together with the address to which the data should be delivered. The network does its best to deliver the packets, but with some probability of the data&apos;s getting lost, duplicated, or damaged., Also, each data item (packet) is independently routed, and the network does not guarantee that the packets will be kept in order, meaning that if packet 1 is sent, followed by packet 2, packet 2 might be delivered before packet 1.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && (MLD8[61] & 0xf0) == 0x80]]></CondExp>
					</PSpec>
					<PSpec Name="Disconn Confirm">
						<PSpecID>8107</PSpecID>
						<LName>CLNP Disconnect Confirm</LName>
						<SName>CLNP Disconn Conf</SName>
						<Desc>There are two models for how a network should look to endnodes. One model is known as connectionless. In this model, an endnode transmits packets on the network, together with the address to which the data should be delivered. The network does its best to deliver the packets, but with some probability of the data&apos;s getting lost, duplicated, or damaged., Also, each data item (packet) is independently routed, and the network does not guarantee that the packets will be kept in order, meaning that if packet 1 is sent, followed by packet 2, packet 2 might be delivered before packet 1.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && (MLD8[61] & 0xf0) == 0xc0]]></CondExp>
					</PSpec>
					<PSpec Name="Conn Confirm">
						<PSpecID>8108</PSpecID>
						<LName>CLNP Connection Confirm</LName>
						<SName>CLNP Conn Conf</SName>
						<Desc>There are two models for how a network should look to endnodes. One model is known as connectionless. In this model, an endnode transmits packets on the network, together with the address to which the data should be delivered. The network does its best to deliver the packets, but with some probability of the data&apos;s getting lost, duplicated, or damaged., Also, each data item (packet) is independently routed, and the network does not guarantee that the packets will be kept in order, meaning that if packet 1 is sent, followed by packet 2, packet 2 might be delivered before packet 1.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && (MLD8[61] & 0xf0) == 0xd0]]></CondExp>
					</PSpec>
					<PSpec Name="Conn Req">
						<PSpecID>8109</PSpecID>
						<LName>CLNP Connection Request</LName>
						<SName>CLNP Conn Req</SName>
						<Desc>There are two models for how a network should look to endnodes. One model is known as connectionless. In this model, an endnode transmits packets on the network, together with the address to which the data should be delivered. The network does its best to deliver the packets, but with some probability of the data&apos;s getting lost, duplicated, or damaged., Also, each data item (packet) is independently routed, and the network does not guarantee that the packets will be kept in order, meaning that if packet 1 is sent, followed by packet 2, packet 2 might be delivered before packet 1.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && (MLD8[61] & 0xf0) == 0xe0]]></CondExp>
					</PSpec>
					<PSpec Name="Data">
						<PSpecID>8110</PSpecID>
						<LName>CLNP Data</LName>
						<SName>CLNP Data</SName>
						<Desc>There are two models for how a network should look to endnodes. One model is known as connectionless. In this model, an endnode transmits packets on the network, together with the address to which the data should be delivered. The network does its best to deliver the packets, but with some probability of the data&apos;s getting lost, duplicated, or damaged., Also, each data item (packet) is independently routed, and the network does not guarantee that the packets will be kept in order, meaning that if packet 1 is sent, followed by packet 2, packet 2 might be delivered before packet 1.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1c && (MLD8[61] & 0xf0) == 0xf0]]></CondExp>
					</PSpec>
				</PSpec>
				<PSpec Name="ES-IS">
					<PSpecID>8150</PSpecID>
					<LName>OSI End System To Intermediate System Protocol</LName>
					<SName>ESIS</SName>
					<Desc>An ISO protocol for handshaking between routers and endnodes and for mapping network layer addresses to data link layer addresses.</Desc>
					<Color>color_10</Color>
					<CondExp><![CDATA[MLD8[0] == 0x82]]></CondExp>
					<PSpec Name="ES Hello">
						<PSpecID>8151</PSpecID>
						<LName>ES-IS End System Hello</LName>
						<SName>ESIS ES Hello</SName>
						<Desc>The ES hello is used to inform intermediate systems of the presence of an endnode system.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x02]]></CondExp>
					</PSpec>
					<PSpec Name="IS Hello">
						<PSpecID>8152</PSpecID>
						<LName>ES-IS Intermediate System Hello</LName>
						<SName>ESIS IS Hello</SName>
						<Desc>The IS hello tells the endnode system about the presence of the router.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x04]]></CondExp>
					</PSpec>
					<PSpec Name="Redirect Message">
						<PSpecID>8153</PSpecID>
						<LName>ES-IS Redirect Message</LName>
						<SName>ESIS Redirect</SName>
						<Desc>The redirect packet is an instruction from an intermediate system that another path should be used for a particular destination. When an intermediate system receives a packet and sends it back onto the same subnetwork, it should not have received the packet in the first place. Rather than continue to perform this unnecessary service, it sends the packet, but also sends a redirect packet which contains a suggestion that, for a given destination, another router should be used. The endnode (or intermediate system) will use this information to update routing tables.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x06]]></CondExp>
					</PSpec>
				</PSpec>
				<PSpec Name="IS-IS">
					<PSpecID>8200</PSpecID>
					<LName>OSI Intermediate System To Intermediate System Protocol</LName>
					<SName>ISIS</SName>
					<Desc>An OSI protocol for routers to dynamically exchange topology information.</Desc>
					<Color>color_11</Color>
					<CondExp><![CDATA[MLD8[0] == 0x83]]></CondExp>
					<PSpec Name="L1 Router Hello">
						<PSpecID>8201</PSpecID>
						<LName>IS-IS Level 1 Router Hello</LName>
						<SName>ISIS L1 RHello</SName>
						<Desc>All routers exchange IS-IS hello packets. The packets allow two neighbors to identify each other as routers and the type of router they are. The packet includes version numbers and minor version numbers, known as ECOs or Engineering Change Orders, and identifiers indicating the type of router sending the information. The source node, in this case, is a level 1 router. The packet also contains a bid for the designated router, which is the router that receives, by default, traffic from end nodes, as well as all valid area addresses, any routing neighbors, and an indication if the node is a designated router.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x0f]]></CondExp>
					</PSpec>
					<PSpec Name="L2 Router Hello">
						<PSpecID>8202</PSpecID>
						<LName>IS-IS Level 2 Router Hello</LName>
						<SName>ISIS L2 RHello</SName>
						<Desc>All routers exchange IS-IS hello packets. The packets allow two neighbors to identify each other as routers and the type of router they are. The packet includes version numbers and minor version numbers, known as ECOs or Engineering Change Orders, and identifiers indicating the type of router sending the information. The source node, in this case, is a level 2 router. The packet also contains a bid for the designated router, which is the router that receives, by default, traffic from end nodes, as well as all valid area addresses, any routing neighbors, and an indication if the node is a designated router.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x10]]></CondExp>
					</PSpec>
					<PSpec Name="PP Hello">
						<PSpecID>8203</PSpecID>
						<LName>IS-IS Point-To-Point Hello</LName>
						<SName>ISIS PP Hello</SName>
						<Desc>An OSI protocol for routers to dynamically exchange topology information.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x11]]></CondExp>
					</PSpec>
					<PSpec Name="L1 LSP">
						<PSpecID>8204</PSpecID>
						<LName>IS-IS Level 1 Link State Packet</LName>
						<SName>ISIS L1 LSP</SName>
						<Desc>Each Level 1 router on the network constructs a Link State Packet (LSP) which contains information on all router and end node neighbors and the overhead involved in reaching those neighbors. By exchanging LSPs, every router knows the current status of every other router and of each router&apos;s neighbors. This information is then used by the decision process to calculate the shortest path(s) between any two nodes.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x12]]></CondExp>
					</PSpec>
					<PSpec Name="L2 LSP">
						<PSpecID>8205</PSpecID>
						<LName>IS-IS Level 2 Link State Packet</LName>
						<SName>ISIS L2 LSP</SName>
						<Desc>Each Level 2 router on the network constructs a Link State Packet (LSP) which contains a list of all area neighbors and the overhead involved in reaching those neighbors. By exchanging LSPs, every router knows the current status of every other router and of each router&apos;s neighbors. This information is then used by the decision process to calculate the shortest path(s) between any two nodes.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x14]]></CondExp>
					</PSpec>
					<PSpec Name="XID">
						<PSpecID>8206</PSpecID>
						<LName>IS-IS Exchange Identification</LName>
						<SName>ISIS XID</SName>
						<Desc>Identification verification is done using an XID packet, which is a simple way of verifying that two nodes are meant to communicate. A simple verification code, equivalent to a password, is stored locally in the circuit database. When an XID packet is received, the verification value is compared to the stored value.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x17]]></CondExp>
					</PSpec>
					<PSpec Name="L1 CSNP">
						<PSpecID>8207</PSpecID>
						<LName>IS-IS Level 1 Complete Sequence Number Packet</LName>
						<SName>ISIS L1 CSNP</SName>
						<Desc>To ensure that Link State Packets (LSPs) are propagated through the network, an explicit acknowledgment scheme is used which is based on a Sequence Numbers Packet (SNP) concept. A sequence number packet describes the LSPs in the LSP database in a compact format, so that neighbor routers can ensure that their databases stay consistent. A sequence numbers packet is never forwarded. It is only transmitted between neighbors. A CSNP includes every LSP in the database. Since there are two LSP databases - level 1 and level 2 - there are CSNPs and PSNPs for each of the levels.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x18]]></CondExp>
					</PSpec>
					<PSpec Name="L2 CSNP">
						<PSpecID>8208</PSpecID>
						<LName>IS-IS Level 2 Complete Sequence Number Packet</LName>
						<SName>ISIS L2 CSNP</SName>
						<DescID>8207</DescID>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x19]]></CondExp>
					</PSpec>
					<PSpec Name="L1 PSNP">
						<PSpecID>8209</PSpecID>
						<LName>IS-IS Level 1 Partial Sequence Number Packet</LName>
						<SName>ISIS L1 PSNP</SName>
						<Desc>A &apos;PSNP&apos; contains some subset of the Link State Packets. A PSNP is primarily used to acknowledge one or more LSPs. It can also be used to request transmission of a specific LSP. Since there are two LSP databases - level 1 and level 2 - there are CSNPs and PSNPs for each of the levels.</Desc>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1a]]></CondExp>
					</PSpec>
					<PSpec Name="L2 PSNP">
						<PSpecID>8210</PSpecID>
						<LName>IS-IS Level 2 Partial Sequence Number Packet</LName>
						<SName>ISIS L2 PSNP</SName>
						<DescID>8209</DescID>
						<CondExp><![CDATA[(MLD8[4] & 0x1f) == 0x1b]]></CondExp>
					</PSpec>
				</PSpec>
			</PSpec>
			<PSpec Name="VINES-IP">
				<PSpecID>4700</PSpecID>
				<LName>Banyan VINES Internet Protocol</LName>
				<SName>VINES IP</SName>
				<DescID>4500</DescID>
				<Color>color_14</Color>
				<CondExp><![CDATA[(PLD8[0] == 0xbc) || (PLD8[1] == 0xbc)]]></CondExp>
				<Link Name="VINES Children"/>
			</PSpec>
			<PSpec Name="XNS">
				<PSpecID>4000</PSpecID>
				<LName>Xerox Network Systems Protocol</LName>
				<SName>XNS</SName>
				<Color>color_13</Color>
				<CondExp><![CDATA[ (PLD8[0] == 0x80) || (PLD8[1] == 0x80) ]]></CondExp>
				<Link Name="XNS Children"/>
			</PSpec>
		</PSpec>
	</PSpec>
	<PSpec Name="TCP/UDP" Type="CommonTable">
		<PSpec Name="SSH">
			<PSpecID>1459</PSpecID>
			<LName>Secure Shell Protocol</LName>
			<SName>SSH</SName>
			<Desc>SSH (Secure Shell) is a program to log into another computer over a network, to execute commands on a remote machine, and to move files from one machine to another. It provides strong authentication and secure communications over unsecured channels. It is intended as a replacement for rlogin, rsh, and rcp.</Desc>
			<CondExp><![CDATA[(SrcPort == 22) || (DestPort == 22)]]></CondExp>
		</PSpec>
		<PSpec Name="Kerberos">
			<PSpecID>1449</PSpecID>
			<LName>Kerberos</LName>
			<SName>Kerberos</SName>
			<Desc>Kerberos is a network authentication protocol, developed by the Massachusetts Institute of Technology, which provides strong authentication for client-server applications by using secret-key cryptography. It uses IP port 88.</Desc>
			<CondExp><![CDATA[(SrcPort == 88) || (DestPort == 88)]]></CondExp>
		</PSpec>
		<PSpec Name="DNS">
			<PSpecID>1413</PSpecID>
			<LName>Domain Name System Protocol</LName>
			<SName>DNS</SName>
			<Desc>DNS is the TCP/IP standard protocol for mapping human-readable names into IP logical addresses. DNS servers maintain a database of associations between hierarchical names and the corresponding addresses so that people and processes may locate each other without needing to know a logical or physical address. This also allows sites to change their underlying IP address scheme without having to reconfigure every other machine on the network.</Desc>
			<Color>color_9</Color>
			<CondExp><![CDATA[(SrcPort == 53) || (DestPort == 53) || (SrcPort == 5353) || (DestPort == 5353)]]></CondExp>
		</PSpec>
		<PSpec Name="BOOTP">
			<PSpecID>1414</PSpecID>
			<LName>Boot Protocol</LName>
			<SName>BOOTP</SName>
			<Desc>BOOTP is used by BOOTP clients to notify BOOTP servers that a machine needs some configuration and an executable image to begin running. A BOOTP server typically sends an IP address for the machine to use and other configuration information including the name and location of an image file that the client should fetch into its memory in order to execute. TFTP is typically used to fetch such an image. BOOTP is most often used in diskless workstation environments.</Desc>
			<Color>color_10</Color>
			<CondExp><![CDATA[(SrcPort == 67) || (DestPort == 67)]]></CondExp>
			<NextLayer>
				<Exp><![CDATA[     236     ]]></Exp>
			</NextLayer>
			<PSpec Name="DHCP">
				<PSpecID>1425</PSpecID>
				<LName>Dynamic Host Configuration Protocol</LName>
				<SName>DHCP</SName>
				<Desc>DHCP provides a framework for passing configuration information to hosts on a TCP/IP network. DHCP is based on the Bootstrap Protocol (BOOTP), adding the capability of automatic and dynamic allocation of reusable network addresses and many other configuration options. DHCP captures the behavior of BOOTP relay agents, and DHCP participants can interoperate with BOOTP participants.</Desc>
				<Color>color_5</Color>
				<CondExp><![CDATA[MLD32[0] == 0x63825363]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="HTTPS">
			<PSpecID>1454</PSpecID>
			<LName>Secure HTTP Protocol</LName>
			<SName>HTTPS</SName>
			<Desc>Secure HTTP (HTTPS) is a means by which the Hypertext Transfer Protocol (HTTP) is transferred encrypted, thereby providing protection for sensitive data, such as credit card numbers. HTTPS typically uses the Secure Sockets Layer (SSL) as its means of encryption. HTTPS uses port 443.</Desc>
			<Color>color_14</Color>
			<CondExp><![CDATA[(SrcPort == 443) || (DestPort == 443)]]></CondExp>
		</PSpec>
		<PSpec Name="Timbuktu">
			<PSpecID>1455</PSpecID>
			<LName>Timbuktu</LName>
			<SName>Timbuktu</SName>
			<Desc>Timbuktu is a software product sold by Netopia, Inc. It allows a user to access a remote machine as if it were being controlled locally. Timbuktu uses IP ports 1417-1420.</Desc>
			<Color>color_14</Color>
			<CondExp><![CDATA[  (SrcPort >= 1417 && SrcPort <= 1420) || (DestPort >= 1417 && DestPort <= 1420)  ]]></CondExp>
		</PSpec>
		<PSpec Name="RTSP">
			<PSpecID>1462</PSpecID>
			<LName>Real Time Streaming Protocol</LName>
			<SName>RTSP</SName>
			<Desc>RTSP is an application-level protocol for control over the delivery of data with real-time properties. RTSP provides an extensible framework to enable controlled on-demand delivery of real-time data, such as audio and video. RTSP most commonly uses IP port 554.</Desc>
			<CondExp><![CDATA[(SrcPort == 554) || (DestPort == 554)]]></CondExp>
		</PSpec>
		<PSpec Name="L2TP">
			<PSpecID>1463</PSpecID>
			<LName>Layer Two Tunneling Protocol</LName>
			<SName>L2TP</SName>
			<Desc>L2TP facilitates the tunneling of PPP (Point to Point Protocol) packets across an intervening network in a way that is as transparent as possible to both end users and applications. L2TP uses IP port 1701.</Desc>
			<CondExp><![CDATA[ ((MLD8[1] & 0x0f) == 2) && (SrcPort == 1701 || DestPort == 1701)   ]]></CondExp>
		</PSpec>
		<PSpec Name="CSO">
			<PSpecID>1410</PSpecID>
			<LName>CS-Net Operations Protocol</LName>
			<SName>CSO</SName>
			<Desc>Most uses of this protocol are now obsolete. However, it is still currently in use as a Mailbox Name Nameserver at Univ. of Wisconsin.</Desc>
			<Color>color_15</Color>
			<CondExp><![CDATA[(SrcPort == 105) || (DestPort == 105)]]></CondExp>
		</PSpec>
		<PSpec Name="NetBIOS">
			<PSpecID>1429</PSpecID>
			<LName>NetBIOS Datagram Service</LName>
			<SName>NetBIOS</SName>
			<Desc>NetBIOS was originally defined by Microsoft as part of their networking strategy known as Open Net and LAN Manager or LANMAN. NetBIOS defines a software interface, not a protocol. In practice however, the IBM PC-Network version has become the standard. Under TCP/UDP a separate set of protocols is used to support all NetBIOS services.</Desc>
			<Color>color_5</Color>
			<CondExp><![CDATA[   (SrcPort >= 137 && SrcPort <= 139) || (DestPort >= 137 && DestPort <= 139)   ]]></CondExp>
			<Link Name="TCP/UDP NetBIOS Children" Sort="Last"/>
			<PSpec Name="Name Svc">
				<PSpecID>1430</PSpecID>
				<LName>NetBIOS Name Service</LName>
				<SName>NB Name Svc</SName>
				<Desc>Under TCP/UDP, NetBIOS Name Service is provided by a mechanism very much like the IP standard Domain Name Service. In fact it uses the same format for messages with just a few extensions.</Desc>
				<Color>color_6</Color>
				<CondExp><![CDATA[(SrcPort == 137) || (DestPort == 137)]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="CMIP Agent">
			<PSpecID>1426</PSpecID>
			<LName>Common Management Information Protocol - CMIP</LName>
			<SName>CMIP</SName>
			<Desc>CMIP, the Common Management Information Protocol, is another protocol used to manage networks. It is more complete, yet larger, than SNMP.</Desc>
			<Color>color_8</Color>
			<CondExp><![CDATA[(SrcPort == 164) || (DestPort == 164)]]></CondExp>
		</PSpec>
		<PSpec Name="Retrospect">
			<PSpecID>1447</PSpecID>
			<LName>Retrospect Remote</LName>
			<SName>Retrospect</SName>
			<Desc>Retrospect Remote is a product sold by Dantz Development Corporation. It performs backup and archiving services of various disks and computers via the network.</Desc>
			<Color>color_9</Color>
			<CondExp><![CDATA[(SrcPort == 497) || (DestPort == 497)]]></CondExp>
		</PSpec>
		<PSpec Name="rlogin">
			<PSpecID>1411</PSpecID>
			<LName>Remote Login Protocol</LName>
			<SName>rlogin</SName>
			<Desc>rlogin is a command and a protocol which began with Berkeley 4.x BSD Unix systems as a service which allows users of one machine to connect to other Unix systems across a TCP/IP internet and then interact as if their terminals were connected to the machines directly. rlogin is superior to TELNET in its implementation, but is not used as widely as TELNET.</Desc>
			<Color>color_9</Color>
			<CondExp><![CDATA[(SrcPort == 513) || (DestPort == 513)]]></CondExp>
		</PSpec>
		<PSpec Name="rsh">
			<PSpecID>1412</PSpecID>
			<LName>Remote Shell Protocol</LName>
			<SName>rsh</SName>
			<Desc>rsh is a command and a protocol which began with Berkeley 4.x BSD Unix systems as a service which allows users of one machine to connect to other Unix systems across a TCP/IP internet and execute a single command line in the Unix shell program of the remote machine as if the two machines were connected directly. Local Unix machines can thereby execute programs located on remote machines, by remote machines and retrieve the results to the local machine.</Desc>
			<Color>color_10</Color>
			<CondExp><![CDATA[(SrcPort == 514) || (DestPort == 514)]]></CondExp>
		</PSpec>
		<PSpec Name="WINS">
			<PSpecID>1453</PSpecID>
			<LName>Windows Internet Name Service</LName>
			<SName>WINS</SName>
			<Desc>WINS is a network service for Microsoft networks that provides Windows computers with Internet numbers for specified NetBIOS names, facilitating browsing and intercommunication over TCP/IP networks.</Desc>
			<CondExp><![CDATA[(SrcPort == 1512) || (DestPort == 1512)]]></CondExp>
		</PSpec>
		<PSpec Name="MSN Messenger">
			<PSpecID>1471</PSpecID>
			<LName>MSN Messenger Service</LName>
			<SName>MSN Messenger</SName>
			<Desc>MSN Messenger Service is a protocol used by Microsoft&apos;s commercial product of the same name. It enables a user to learn about the presence of other people on the Internet, and to communicate with them in real-time. MSN Messenger Service uses IP port 1863.</Desc>
			<Color>color_13</Color>
			<CondExp><![CDATA[(SrcPort == 1863) || (DestPort == 1863)]]></CondExp>
		</PSpec>
		<PSpec Name="RPC/NFS">
			<PSpecID>1421</PSpecID>
			<LName>Remote Procedure Call/Network File System Protocol</LName>
			<SName>RPC/NFS</SName>
			<Desc>NFS and RPC are protocols developed by SUN Microsystems that allow a set of cooperating computers to access each other&apos;s file systems as if they were local to each other. A key feature of NFS is that it hides the systemic differences between local and remote files and file systems by placing them in the same well-defined data and name space.</Desc>
			<Color>color_13</Color>
			<CondExp><![CDATA[(SrcPort == 2049) || (DestPort == 2049)]]></CondExp>
		</PSpec>
		<PSpec Name="RPC">
			<PSpecID>1456</PSpecID>
			<LName>Remote Procedure Call</LName>
			<SName>RPC</SName>
			<Desc>RPC is a protocol, developed by SUN Microsystems that allows one program to request a service from a program located on another computer across a network, without having to understand the details of the network. RPC uses IP port 111.</Desc>
			<Color>color_13</Color>
			<CondExp><![CDATA[(SrcPort == 111) || (DestPort == 111)]]></CondExp>
		</PSpec>
		<PSpec Name="Lotus Notes">
			<PSpecID>1457</PSpecID>
			<LName>Lotus Notes</LName>
			<SName>Lotus Notes</SName>
			<Desc>Lotus Notes is a client-server groupware product sold by Lotus. It uses IP port 1352.</Desc>
			<Color>color_13</Color>
			<CondExp><![CDATA[(SrcPort == 1352) || (DestPort == 1352)]]></CondExp>
		</PSpec>
		<PSpec Name="FileMaker">
			<PSpecID>1465</PSpecID>
			<LName>FileMaker</LName>
			<SName>FileMaker</SName>
			<Desc>FileMaker, Inc. provides a database product, called FileMaker Pro, which uses this proprietary transport mechanism for accessing databases over TCP/IP. FileMaker uses IP port 5003.</Desc>
			<Color>color_9</Color>
			<CondExp><![CDATA[(SrcPort == 5003) || (DestPort == 5003)]]></CondExp>
		</PSpec>
		<PSpec Name="AOL">
			<PSpecID>1460</PSpecID>
			<LName>America Online</LName>
			<SName>AOL</SName>
			<Desc>AOL (America Online) provides Internet online services such as e-mail, software downloading, and chat rooms. AOL uses IP port 5190.</Desc>
			<Color>color_9</Color>
			<CondExp><![CDATA[(SrcPort == 5190) || (DestPort == 5190)]]></CondExp>
		</PSpec>
		<PSpec Name="CU-SeeMe">
			<PSpecID>1424</PSpecID>
			<LName>Cornell University SeeMe Protocol</LName>
			<SName>CU-SeeMe</SName>
			<Desc>CU-SeeMe is an experimental protocol used to attach visual and graphical images to a formal messaging system like electronic mail. It is popularly used on the internet for video-conferencing</Desc>
			<Color>color_15</Color>
			<CondExp><![CDATA[(SrcPort == 7648) || (DestPort == 7648)]]></CondExp>
		</PSpec>
		<PSpec Name="HTTP Proxy">
			<PSpecID>1427</PSpecID>
			<LName>HTTP Proxy Protocol</LName>
			<SName>HTTP Proxy</SName>
			<Desc>A proxy server is used so that another node (or address) can act as an intermediary for network transactions between a client and server. It is a useful mechanism to implement security when used in conjunction with firewalls and routers.</Desc>
			<Color>color_2</Color>
			<CondExp><![CDATA[(SrcPort == 8080) || (DestPort == 8080)]]></CondExp>
		</PSpec>
		<PSpec Name="CIFS">
			<PSpecID>2461</PSpecID>
			<LName>Common Internet File System</LName>
			<SName>CIFS</SName>
			<Desc>Microsoft&apos;s Common Internet File System (CIFS) is the standard way that computer users share files across corporate intranets and the Internet. An enhanced version of the Microsoft open, cross-platform Server Message Block (SMB) protocol, CIFS is a native file-sharing protocol in Windows 2000.</Desc>
			<Color>color_2</Color>
			<CondExp><![CDATA[(SrcPort == 445) || (DestPort == 445)]]></CondExp>
		</PSpec>
		<PSpec Name="SQL">
			<PSpecID>2466</PSpecID>
			<LName>SQL Services</LName>
			<SName>SQL</SName>
			<Desc>ISO/ANSI standard Sequential Query Language (SQL) services port</Desc>
			<Color>color_2</Color>
			<CondExp><![CDATA[(SrcPort == 118) || (DestPort == 118)]]></CondExp>
		</PSpec>
		<PSpec Name="NCP">
			<PSpecID>2467</PSpecID>
			<LName>Netware Core Protocol</LName>
			<SName>NCP</SName>
			<Desc>NetWare Core Protocol (NCP) is a series of server routines designed to satisfy application requests coming from, for example, the NetWare shell. The services provided by NCP include file access, printer access, name management, accounting, security, and file synchronization.</Desc>
			<Color>color_2</Color>
			<CondExp><![CDATA[(SrcPort == 524) || (DestPort == 524)]]></CondExp>
		</PSpec>
		<PSpec Name="SLP">
			<PSpecID>2469</PSpecID>
			<LName>Service Location Protocol</LName>
			<SName>SLP</SName>
			<Desc>The Service Location Protocol provides the same function in IP networks as SAP provides in IPX networks. It registers information in a database and allows clients to query the database to find services.</Desc>
			<CondExp><![CDATA[(SrcPort == 427) || (DestPort == 427)]]></CondExp>
		</PSpec>
		<PSpec Name="PPTP">
			<PSpecID>2472</PSpecID>
			<LName>Point-to-Point Tunneling Protocol</LName>
			<SName>PPTP</SName>
			<Desc>Point-to-Point Tunneling Protocol (PPTP) allows existing Network Access Server (NAS) functions to be separated using a client-server architecture. PPTP uses an extended version of GRE to carry user PPP packets. These enhancements allow for low-level congestion and flow control to be provided on the tunnels used to carry user data. This mechanism allows for efficient use of the bandwidth available for the tunnels and avoids unnecessary retransmisions and buffer overruns.</Desc>
			<CondExp><![CDATA[(SrcPort == 1723) || (DestPort == 1723)]]></CondExp>
		</PSpec>
		<PSpec Name="SIP">
			<PSpecID>2474</PSpecID>
			<LName>Session Initiation Protocol</LName>
			<SName>SIP</SName>
			<Desc>The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol for creating, modifying and terminating sessions with one or more participants. These sessions include Internet multimedia conferences, Internet telephone calls and multimedia distribution.  Members in a session can communicate via multicast or via a mesh of unicast relations, or a combination of these.</Desc>
			<CondExp><![CDATA[(SrcPort == 5060) || (DestPort == 5060)]]></CondExp>
		</PSpec>
		<PSpec Name="MGCP">
			<PSpecID>2483</PSpecID>
			<LName>Media Gateway Control Protocol</LName>
			<SName>MGCP</SName>
			<Desc>MGCP is used for controlling Telephony Gateways from external call control elements called media gateway controllers or call agents. A telephony gateway is a network element that provides conversion between the audio signals carried on telephone circuits and data packets carried over the Internet or over other packet networks.</Desc>
			<CondExp><![CDATA[(SrcPort == 2427) || (DestPort == 2427) || (SrcPort == 2727) || (DestPort == 2727)]]></CondExp>
		</PSpec>
		<PSpec Name="SAP">
			<PSpecID>2500</PSpecID>
			<LName>Session Announcment Protocol</LName>
			<SName>SAP</SName>
			<Desc>a SAP announcer periodically sends an announcement packet to a well known multicast address and port. There is no rendezvous mechanism; the SAP announcer is not aware of the presence or absence of any SAP listeners.</Desc>
			<CondExp><![CDATA[(SrcPort == 9875) || (DestPort == 9875)]]></CondExp>
		</PSpec>
		<PSpec Name="H.323 Host Call">
			<PSpecID>2490</PSpecID>
			<LName>H.323 Host Call</LName>
			<SName>H.323 Host Call</SName>
			<Desc>H.323 is an ITU-T standard that defines how to conduct multimedia communication over packet switched networks with non-guaranteed quality of service. H.323 data communication most commonly occurs over ephemeral ports, but the session setup goes over port 1720.</Desc>
			<CondExp><![CDATA[(SrcPort == 1720) || (DestPort == 1720)]]></CondExp>
			<PSpec Name="Q.931 Basic Call Control">
				<PSpecID>2501</PSpecID>
				<LName>Q.931 Basic Call Control</LName>
				<SName>Q.931</SName>
				<Desc>Q.931 is ISDN's connection control protocol, roughly comparable to TCP in the Internet protocol stack. Q.931 doesn't provide flow control or perform retransmission, since the underlying layers are assumed to be reliable and the circuit-oriented nature of ISDN allocates bandwidth in fixed increments of 64 kbps. Q.931 does manage connection setup and breakdown. Like TCP, Q.931 documents both the protocol itself and a protocol state machine.</Desc>
				<CondExp><![CDATA[((MLD16[0] == 0x300) && (MLD8[4] == 8)) || (MLD8[0] == 8)]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="H.225">
			<PSpecID>2491</PSpecID>
			<LName>H.225</LName>
			<SName>H.225</SName>
			<Desc>H.323 is an ITU-T standard that defines how to conduct multimedia communication over packet switched networks with non-guaranteed quality of service.</Desc>
			<CondExp><![CDATA[(SrcPort == 1719) || (DestPort == 1719) || (SrcPort == 1718) || (DestPort == 1718)]]></CondExp>
		</PSpec>
		<PSpec Name="Citrix ICA">
			<PSpecID>2502</PSpecID>
			<LName>Citrix ICA</LName>
			<SName>Citrix ICA</SName>
			<Desc>Citrix® Independent Computing Architecture (ICA®) technology provides the foundation for deploying applications and information onto other devices.</Desc>
			<CondExp><![CDATA[(SrcPort == 1494) || (DestPort == 1494)]]></CondExp>
		</PSpec>
		<PSpec Name="GTP">
			<PSpecID>2498</PSpecID>
			<LName>GPRS Tunneling Protocol</LName>
			<SName>GTP</SName>
			<Desc>In General Packet Radio Service [gprs] backbone network GPRS Tunnelling Protocol [GTP] is a high level tunnelling protocol used to carry signalling and data. GPRS backbone network contains several nodes of GPRS Support Node [GSN], which communicate with each other using IP. GSNs are used to communicate with Mobile Terminal equipment and relay data inside the backbone network to outside connections which in turn are controlled by Gateway GPRS Support Nodes. This relaying is implemented in the backbone network using GTP on top of UDP or TCP, on port 3386.</Desc>
			<CondExp><![CDATA[(SrcPort == 3386) || (DestPort == 3386)]]></CondExp>
		</PSpec>
		<PSpec Name="LDAP">
			<PSpecID>1473</PSpecID>
			<LName>Lightweight Directory Access Protocol</LName>
			<SName>LDAP</SName>
			<Desc>The general model adopted by this protocol is one of clients performing protocol operations against servers. In this model, this is accomplished by a client transmitting a protocol request describing the operation to be performed to a server, which is then responsible for performing the necessary operations on the Directory.  Upon completion of the necessary operations, the server returns a response containing any results or errors to the requesting client.  In keeping with the goal of easing the costs associated with use of the Directory, it is an objective of this protocol to minimize the complexity of clients so as to facilitate widespread deployment of applications capable of utilizing the Directory.</Desc>
			<CondExp><![CDATA[(SrcPort == 389) || (DestPort == 389)]]></CondExp>
		</PSpec>
	</PSpec>
	<PSpec Name="IPX Children" Type="CommonTable">
		<PSpec Name="RIP">
			<PSpecID>3002</PSpecID>
			<LName>NetWare IPX Routing Information Protocol</LName>
			<SName>NW RIP</SName>
			<Desc>NetWare RIP is a distance-vector routing protocol. Distance-vector routing protocols typically exchange information about the network&apos;s topology through periodic broadcasts with their immediate router neighbors. RIP packets use the IPX protocol for transport and designate the value 0x0453 in the IPX socket field. RIP broadcasts are restricted to the local network only and allow routers to propagate the routing information onto other networks. Each router maintains a table of known routes and broadcasts this information on each locally attached segment. Other routers receive this information, update their routing tables, and send an up-to-date routing information packet. RIP packets are not allowed to cross routers.</Desc>
			<Color>color_2</Color>
			<CondExp><![CDATA[(MLD16[16] == 0x0453) || (MLD16[28] == 0x0453)]]></CondExp>
			<PSpec Name="Request">
				<PSpecID>3037</PSpecID>
				<LName>NetWare RIP Request</LName>
				<SName>RIP Request</SName>
				<Desc>NetWare RIP is a distance-vector routing protocol. Distance-vector routing protocols typically exchange information about the network&apos;s topology through periodic broadcasts with their immediate router neighbors. RIP packets use the IPX protocol for transport and designate the value 0x0453 in the IPX socket field. RIP broadcasts are restricted to the local network only and allow routers to propagate the routing information onto other networks. Each router maintains a table of known routes and broadcasts this information on each locally attached segment. Other routers receive this information, update their routing tables, and send an up-to-date routing information packet. RIP packets are not allowed to cross routers.</Desc>
				<CondExp><![CDATA[MLD16[30] == 0x0001]]></CondExp>
			</PSpec>
			<PSpec Name="Reply">
				<PSpecID>3038</PSpecID>
				<LName>NetWare RIP Reply</LName>
				<SName>RIP Reply</SName>
				<Desc>NetWare RIP is a distance-vector routing protocol. Distance-vector routing protocols typically exchange information about the network&apos;s topology through periodic broadcasts with their immediate router neighbors. RIP packets use the IPX protocol for transport and designate the value 0x0453 in the IPX socket field. RIP broadcasts are restricted to the local network only and allow routers to propagate the routing information onto other networks. Each router maintains a table of known routes and broadcasts this information on each locally attached segment. Other routers receive this information, update their routing tables, and send an up-to-date routing information packet. RIP packets are not allowed to cross routers.</Desc>
				<CondExp><![CDATA[MLD16[30] == 0x0002]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="SPP/SPX">
			<PSpecID>3001</PSpecID>
			<LName>NetWare IPX Sequenced Packet Protocol</LName>
			<SName>NW SPX</SName>
			<Desc>When a NetWare client and server communicate, they may be using either connection-oriented or connectionless services. Connection-oriented communications use Novell&apos;s sequenced Packet Exchange (SPX and SPX II) protocols. Connectionless communications use Novell&apos;s Internetwork Packet Exchange (IPX) protocol. SPX provides sequenced and acknowledged communications. An SPX header is always 42 bytes long and begins with the same initial fields as an IPX packet.</Desc>
			<Color>color_6</Color>
			<CondExp><![CDATA[MLD8[5] == 0x05]]></CondExp>
		</PSpec>
		<PSpec Name="NCP">
			<PSpecID>3004</PSpecID>
			<LName>NetWare IPX NetWare Core Protocol</LName>
			<SName>NW NCP</SName>
			<Desc>NCP is the language NetWare servers and clients speak. Clients make requests of servers using the NetWare Core Protocol. Workstations transmit NCP messages to requests file reads and writes, create queue jobs, determine drive mappings, search through directories, etc. Servers answer with NCP replies. NCP Requests and replies each contain a unique header that is of fixed length and followed by a variable data portion. The NCP Request header contains five fields, the NCP Reply header has 7.</Desc>
			<Color>color_2</Color>
			<CondExp><![CDATA[(MLD16[16] == 0x0451) || (MLD16[28] == 0x0451)]]></CondExp>
			<PSpec Name="Conn Req">
				<PSpecID>3014</PSpecID>
				<LName>NetWare NCP Connection Request</LName>
				<SName>NCP Conn Req</SName>
				<Desc>NCP is the language NetWare servers and clients speak. Clients make requests of servers using the NetWare Core Protocol. Workstations transmit NCP messages to requests file reads and writes, create queue jobs, determine drive mappings, search through directories, etc. Servers answer with NCP replies. NCP Requests and replies each contain a unique header that is of fixed length and followed by a variable data portion. The NCP Request header contains five fields, the NCP Reply header has 7.</Desc>
				<CondExp><![CDATA[MLD16[30] == 0x1111]]></CondExp>
			</PSpec>
			<PSpec Name="Request">
				<PSpecID>3015</PSpecID>
				<LName>NetWare NCP Request</LName>
				<SName>NCP Request</SName>
				<Desc>NCP is the language NetWare servers and clients speak. Clients make requests of servers using the NetWare Core Protocol. Workstations transmit NCP messages to requests file reads and writes, create queue jobs, determine drive mappings, search through directories, etc. Servers answer with NCP replies. NCP Requests and replies each contain a unique header that is of fixed length and followed by a variable data portion. The NCP Request header contains five fields, the NCP Reply header has 7.</Desc>
				<CondExp><![CDATA[MLD16[30] == 0x2222]]></CondExp>
			</PSpec>
			<PSpec Name="Reply">
				<PSpecID>3016</PSpecID>
				<LName>NetWare NCP Reply</LName>
				<SName>NCP Reply</SName>
				<Desc>NCP is the language NetWare servers and clients speak. Clients make requests of servers using the NetWare Core Protocol. Workstations transmit NCP messages to requests file reads and writes, create queue jobs, determine drive mappings, search through directories, etc. Servers answer with NCP replies. NCP Requests and replies each contain a unique header that is of fixed length and followed by a variable data portion. The NCP Request header contains five fields, the NCP Reply header has 7.</Desc>
				<CondExp><![CDATA[MLD16[30] == 0x3333]]></CondExp>
			</PSpec>
			<PSpec Name="Destroy">
				<PSpecID>3017</PSpecID>
				<LName>NetWare NCP Destroy Connection</LName>
				<SName>NCP Destroy</SName>
				<Desc>NCP is the language NetWare servers and clients speak. Clients make requests of servers using the NetWare Core Protocol. Workstations transmit NCP messages to requests file reads and writes, create queue jobs, determine drive mappings, search through directories, etc. Servers answer with NCP replies. NCP Requests and replies each contain a unique header that is of fixed length and followed by a variable data portion. The NCP Request header contains five fields, the NCP Reply header has 7.</Desc>
				<CondExp><![CDATA[MLD16[30] == 0x5555]]></CondExp>
			</PSpec>
			<PSpec Name="Burst">
				<PSpecID>3018</PSpecID>
				<LName>NetWare NCP Burst</LName>
				<SName>NCP Burst</SName>
				<Desc>NCP is the language NetWare servers and clients speak. Clients make requests of servers using the NetWare Core Protocol. Workstations transmit NCP messages to requests file reads and writes, create queue jobs, determine drive mappings, search through directories, etc. Servers answer with NCP replies. NCP Requests and replies each contain a unique header that is of fixed length and followed by a variable data portion. The NCP Request header contains five fields, the NCP Reply header has 7.</Desc>
				<CondExp><![CDATA[MLD16[30] == 0x7777]]></CondExp>
			</PSpec>
			<PSpec Name="Delay">
				<PSpecID>3019</PSpecID>
				<LName>NetWare NCP Server Delay</LName>
				<SName>NCP Delay</SName>
				<Desc>NCP is the language NetWare servers and clients speak. Clients make requests of servers using the NetWare Core Protocol. Workstations transmit NCP messages to requests file reads and writes, create queue jobs, determine drive mappings, search through directories, etc. Servers answer with NCP replies. NCP Requests and replies each contain a unique header that is of fixed length and followed by a variable data portion. The NCP Request header contains five fields, the NCP Reply header has 7.</Desc>
				<CondExp><![CDATA[MLD16[30] == 0x9999]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="NetBIOS">
			<PSpecID>3006</PSpecID>
			<LName>NetWare IPX Network Basic Input/Ouput System Protocol</LName>
			<SName>NW NBIOS</SName>
			<Desc>A Network protocol that allows a client program to find a server process and communicate with it.</Desc>
			<Color>color_5</Color>
			<CondExp><![CDATA[(MLD8[5] == 0x14) || (MLD16[16] == 0x0455) || (MLD16[28] == 0x0455)]]></CondExp>
		</PSpec>
		<PSpec Name="SAP">
			<PSpecID>3003</PSpecID>
			<LName>NetWare IPX Service Advertising Protocol</LName>
			<SName>NW SAP</SName>
			<Desc>Service Advertising Protocol services provide information on all known servers throughout the entire internetwork. SAP packets use IPX for transport and are defined by the value 0x0452 in the Destination and Source Socket fields of the IPX header. The 3 types of SAP packets that may be seen on a NetWare LAN are Periodic SAP Information Broadcasts, which are broadcast on the network every 60 seconds so that routers and servers maintain current information about network services, SAP Service Queries, which are sent when a workstation wishes to know about services available on the internetwork, and SAP Service Responses. There are two types of service response packets: General Service responses and Nearest Service responses. SAP responses can contain information for up to 7 servers by repeating the server type through Intermediate Networks fields in a single SAP response. General service responses are used only for service information broadcasts.</Desc>
			<CondExp><![CDATA[(MLD16[16] == 0x0452) || (MLD16[28] == 0x0452)]]></CondExp>
			<PSpec Name="Request">
				<PSpecID>3033</PSpecID>
				<LName>NetWare SAP Request</LName>
				<SName>SAP Request</SName>
				<Desc>Service Advertising Protocol services provide information on all known servers throughout the entire internetwork. SAP packets use IPX for transport and are defined by the value 0x0452 in the Destination and Source Socket fields of the IPX header. The 3 types of SAP packets that may be seen on a NetWare LAN are Periodic SAP Information Broadcasts, which are broadcast on the network every 60 seconds so that routers and servers maintain current information about network services, SAP Service Queries, which are sent when a workstation wishes to know about services available on the internetwork, and SAP Service Responses. There are two types of service response packets: General Service responses and Nearest Service responses. SAP responses can contain information for up to 7 servers by repeating the server type through Intermediate Networks fields in a single SAP response. General service responses are used only for service information broadcasts.</Desc>
				<CondExp><![CDATA[(MLD16[30] == 0x0003) || (MLD16[30] == 0x0001)]]></CondExp>
			</PSpec>
			<PSpec Name="Reply">
				<PSpecID>3034</PSpecID>
				<LName>NetWare SAP Reply</LName>
				<SName>SAP Reply</SName>
				<Desc>Service Advertising Protocol services provide information on all known servers throughout the entire internetwork. SAP packets use IPX for transport and are defined by the value 0x0452 in the Destination and Source Socket fields of the IPX header. The 3 types of SAP packets that may be seen on a NetWare LAN are Periodic SAP Information Broadcasts, which are broadcast on the network every 60 seconds so that routers and servers maintain current information about network services, SAP Service Queries, which are sent when a workstation wishes to know about services available on the internetwork, and SAP Service Responses. There are two types of service response packets: General Service responses and Nearest Service responses. SAP responses can contain information for up to 7 servers by repeating the server type through Intermediate Networks fields in a single SAP response. General service responses are used only for service information broadcasts.</Desc>
				<CondExp><![CDATA[(MLD16[30] == 0x0002) || (MLD16[30] == 0x0004)]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="NLSP">
			<PSpecID>3005</PSpecID>
			<LName>NetWare Link Services Protocol</LName>
			<SName>NW NLSP</SName>
			<Desc>NetWare NLSP is a link-state routing protocol. A link-state router or server floods the network with routing information about itself and its immediate neighbor routers to every router in the routing area. These flooding transmissions are sent only when something changes on the network. There is no need for periodic broadcasts of routing information, unlike with distance-vector routing protocols, such as RIP. Link-state routers use the information they receive to build a map of the routing area&apos;s routers, servers, links, and the operational status of the links (hence the name &quot;link-state&quot;). NLSP packets use the IPX protocol for transport and designate the value 0x9001 in the IPX socket field.</Desc>
			<CondExp><![CDATA[(MLD16[16] == 0x9001) || (MLD16[28] == 0x9001)]]></CondExp>
			<PSpec Name="LAN Hello">
				<PSpecID>3025</PSpecID>
				<LName>NetWare NLSP LAN Hello</LName>
				<SName>NLSP LAN Hello</SName>
				<Desc>NLSP routers transmit hello packets onto their locally attached networks when they come up. The router with the highest priority becomes the &quot;designated router&quot; for that network. Hello packets are sent every 10 seconds by the designated router, and every 20 seconds by all other routers connected to the network. When a router sees another router&apos;s hello packet, the router knows that it has a neighboring router, and will include the neighboring routers&apos;s MAC address in its next hello packet. This is the means by which NLSP routers &quot;learn&quot; about all their neighbors.</Desc>
				<CondExp><![CDATA[(MLD8[34] & 0x1f) == 0x0f]]></CondExp>
			</PSpec>
			<PSpec Name="LSP">
				<PSpecID>3026</PSpecID>
				<LName>NetWare NLSP Link State Packet</LName>
				<SName>NLSP LSP</SName>
				<Desc>Link state packets include information about the local environment. Using this information, routers can build a conceptual diagram of the network and the costs to travel in each direction. LSPs can be sent to either the broadcast address or a multicast address.</Desc>
				<CondExp><![CDATA[(MLD8[34] & 0x1f) == 0x12]]></CondExp>
			</PSpec>
			<PSpec Name="CSNP">
				<PSpecID>3027</PSpecID>
				<LName>NetWare NLSP CSNP</LName>
				<SName>NLSP CSNP</SName>
				<Desc>Complete Sequence Number Packets (CSNPs) contain a list of all the LSP ID numbers and their associated sequence numbers and checksum values. The designated NLSP router periodically broadcasts a CSNP to its neighboring routers. Neighboring routers use the information contained therein to update their link state databases.</Desc>
				<CondExp><![CDATA[(MLD8[34] & 0x1f) == 0x18]]></CondExp>
			</PSpec>
			<PSpec Name="PSNP">
				<PSpecID>3028</PSpecID>
				<LName>NetWare NLSP PSNP</LName>
				<SName>NLSP PSNP</SName>
				<Desc>Partial Sequence Number Packets (PSNPs) are sent by routers that require more information on certain LSP IDs after receiving a CNSP from the designated router.</Desc>
				<CondExp><![CDATA[(MLD8[34] & 0x1f) == 0x1a]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="Diagnostic">
			<PSpecID>3007</PSpecID>
			<LName>NetWare IPX Diagnostic Processes</LName>
			<SName>NW Diagnostic</SName>
			<Desc>IPX is the lowest common protocol layer for implementing all of NetWare&apos;s higher level functions.</Desc>
			<CondExp><![CDATA[(MLD16[16] == 0x0456) || (MLD16[28] == 0x0456)]]></CondExp>
		</PSpec>
		<PSpec Name="Serialization">
			<PSpecID>3008</PSpecID>
			<LName>NetWare IPX Serialization</LName>
			<SName>NW Serial</SName>
			<Desc>IPX is the lowest common protocol layer for implementing all of NetWare&apos;s higher level functions.</Desc>
			<CondExp><![CDATA[(MLD16[16] == 0x0457) || (MLD16[28] == 0x0457)]]></CondExp>
		</PSpec>
	</PSpec>
	<PSpec Name="VINES Children" Type="CommonTable">
		<PSpec Name="IPC">
			<PSpecID>4502</PSpecID>
			<LName>VINES Interprocess Communications Protocol</LName>
			<SName>VINES IPC</SName>
			<Desc>IPC moves unreliable datagrams or reliable messages between transport layer ports in the network. A single IPC entity implements the IPC protocol on each VINES node. An unreliable datagrams consists of a single packet that is transferred from a single source port to one or more destination ports. A reliable message consists of a set of data packets (from one to four) that is transferred from one source port to one destination port. The IPC entity re-assembles multiple packets of a reliable message. It presents it as a single unit to the process that owns the socket within the transport layer port.</Desc>
			<Color>color_5</Color>
			<CondExp><![CDATA[MLD8[5] == 0x01]]></CondExp>
		</PSpec>
		<PSpec Name="SPP">
			<PSpecID>4503</PSpecID>
			<LName>VINES Sequenced Packet Protocol</LName>
			<SName>VINES SPP</SName>
			<Desc>SPP provides transport layer support for virtual connections. An SPP virtual connection is an association between two transport layer ports anywhere in the network. Any single transport layer port can support multiple SPP virtual connections simultaneously. Data messages of unlimited size can be transferred on an SPP virtual connection. SPP guarantees that data messages are delivered only once and in proper order. A single SPP entity exists on a node.</Desc>
			<Color>color_6</Color>
			<CondExp><![CDATA[MLD8[5] == 0x02]]></CondExp>
		</PSpec>
		<PSpec Name="ARP">
			<PSpecID>4504</PSpecID>
			<LName>VINES Address Resolution Protocol</LName>
			<SName>VINES ARP</SName>
			<Desc>ARP assigns unique VINES internet addresses to nodes without internet addresses. VINES ARP employs the services of VINES IP to move packets between nodes. Two implementations of VINES ARP are currently supported. Sequenced ARP is designed to work with sequenced RTP. When the routing server assigns the VINES internet address to the client, it also includes its sequence number and a routing metric for reaching it. Non-Sequenced ARP is designed to work with non-sequenced RTP, and is simpler than sequenced ARP. When the routing server assigns the client VINES internet address, the routing server only assigns the address, and passes no other information.</Desc>
			<Color>color_7</Color>
			<CondExp><![CDATA[MLD8[5] == 0x04]]></CondExp>
		</PSpec>
		<PSpec Name="RTP">
			<PSpecID>4505</PSpecID>
			<LName>VINES Routing Update Protocol</LName>
			<SName>VINES RTP</SName>
			<Desc>A network layer protocol that distributes routing information to support the routing services provided by VINES IP. RTP packets have a 4-byte header that follows the VINES IP header. In some RTP packet types, the RTP header is followed by other RTP information, such as tuples. RTP packets are always sent with the destination VINES IP address set to the broadcast address. In most cases, the destination data link address identifies a specific node, such as a routing server or client. Routing update packets use a broadcast data link address on LANs and are sent directly on WAN connections.</Desc>
			<Color>color_8</Color>
			<CondExp><![CDATA[MLD8[5] == 0x05]]></CondExp>
		</PSpec>
		<PSpec Name="ICP">
			<PSpecID>4506</PSpecID>
			<LName>VINES Internet Control Packet</LName>
			<SName>VINES ICP</SName>
			<Desc>A VINES network layer protocol that provides support functions to certain transport layer service entities. ICP support includes providing notification on some network errors and topological conditions.</Desc>
			<Color>color_9</Color>
			<CondExp><![CDATA[MLD8[5] == 0x06]]></CondExp>
		</PSpec>
	</PSpec>
	<PSpec Name="NetBIOS SMB" Type="CommonTable">
		<PSpec Name="SMB">
			<PSpecID>6100</PSpecID>
			<LName>NetBIOS Server Message Block</LName>
			<SName>SMB</SName>
			<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
			<Color>color_2</Color>
			<CondExp><![CDATA[MLD24[1] == 5459266]]></CondExp>
			<Definitions>
				<Define>
					<Name>SMBCmd</Name>
					<Value><![CDATA[MLD8[4]]]></Value>
				</Define>
			</Definitions>
			<PSpec Name="Create Dir">
				<PSpecID>6101</PSpecID>
				<LName>SMB Create Directory</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent from the redirector to a server to do the MKDIR (make directory) function.</Desc>
				<CondExp><![CDATA[SMBCmd == 0]]></CondExp>
			</PSpec>
			<PSpec Name="Delete Dir">
				<PSpecID>6102</PSpecID>
				<LName>SMB Delete Directory</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent from the redirector to a server to do the DLDIR (delete directory) function.</Desc>
				<CondExp><![CDATA[SMBCmd == 1]]></CondExp>
			</PSpec>
			<PSpec Name="Open File">
				<PSpecID>6103</PSpecID>
				<LName>SMB Open File</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to a server to open a file and return the file handle.</Desc>
				<CondExp><![CDATA[SMBCmd == 2]]></CondExp>
			</PSpec>
			<PSpec Name="Create File">
				<PSpecID>6104</PSpecID>
				<LName>SMB Create File</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to a server to create a new file and return a handle. It is also used to delete an old file and create a new one with the same name. The request is rejected if the file is open or the file attribute is set to read only.</Desc>
				<CondExp><![CDATA[SMBCmd == 3]]></CondExp>
			</PSpec>
			<PSpec Name="Close File">
				<PSpecID>6105</PSpecID>
				<LName>SMB Close File</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to a server to close a file. The redirector sends the file handle.</Desc>
				<CondExp><![CDATA[SMBCmd == 4]]></CondExp>
			</PSpec>
			<PSpec Name="Flush File">
				<PSpecID>6106</PSpecID>
				<LName>SMB Flush File</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to a server to flush a file from its directory.</Desc>
				<CondExp><![CDATA[SMBCmd == 5]]></CondExp>
			</PSpec>
			<PSpec Name="Delete File">
				<PSpecID>6107</PSpecID>
				<LName>SMB Delete File</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to a server to delete a file. The redirector specifies the file handle. The request is rejected if a file is open or marked as read only.</Desc>
				<CondExp><![CDATA[SMBCmd == 6]]></CondExp>
			</PSpec>
			<PSpec Name="Rename File">
				<PSpecID>6108</PSpecID>
				<LName>SMB Rename File</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to a server to rename a file.</Desc>
				<CondExp><![CDATA[SMBCmd == 7]]></CondExp>
			</PSpec>
			<PSpec Name="Get File Attr">
				<PSpecID>6109</PSpecID>
				<LName>SMB Get File Attributes</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to a server to obtain the file&apos;s attributes, time of last access, and size.</Desc>
				<CondExp><![CDATA[SMBCmd == 8]]></CondExp>
			</PSpec>
			<PSpec Name="Set File Attr">
				<PSpecID>6110</PSpecID>
				<LName>SMB Set File Attributes</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to a server to set file attributes.</Desc>
				<CondExp><![CDATA[SMBCmd == 9]]></CondExp>
			</PSpec>
			<PSpec Name="Read From File">
				<PSpecID>6111</PSpecID>
				<LName>SMB Read From File</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to the server to read a block of data from a file.</Desc>
				<CondExp><![CDATA[SMBCmd == 10]]></CondExp>
			</PSpec>
			<PSpec Name="Write To File">
				<PSpecID>6112</PSpecID>
				<LName>SMB Write To File</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to the server to write a block of data to a file.</Desc>
				<CondExp><![CDATA[SMBCmd == 11]]></CondExp>
			</PSpec>
			<PSpec Name="Lock Byte Range">
				<PSpecID>6113</PSpecID>
				<LName>SMB Lock Byte Range</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to a server to lock a range of bytes within a file. The range can be from one byte to the entire file. The request is rejected if any byte overlaps a range already locked.</Desc>
				<CondExp><![CDATA[SMBCmd == 12]]></CondExp>
			</PSpec>
			<PSpec Name="Unlock Byte Range">
				<PSpecID>6114</PSpecID>
				<LName>SMB Unlock Byte Range</LName>
				<SName>SMB</SName>
				<Desc>Complement of Lock Byte Range. Session Control Command sent by the redirector to a server to unlock a range of bytes within a file.</Desc>
				<CondExp><![CDATA[SMBCmd == 13]]></CondExp>
			</PSpec>
			<PSpec Name="Create Temp File">
				<PSpecID>6115</PSpecID>
				<LName>SMB Create Temporary File</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to a server to create a unique file name for a temporary file. The server generates the file name and then returns it to the redirector.</Desc>
				<CondExp><![CDATA[SMBCmd == 14]]></CondExp>
			</PSpec>
			<PSpec Name="Make New File">
				<PSpecID>6116</PSpecID>
				<LName>SMB Make New File</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to a server to create a unique file name for a file. The server generates a file name that is unique to files already in that directory and then returns it to the redirector.</Desc>
				<CondExp><![CDATA[SMBCmd == 15]]></CondExp>
			</PSpec>
			<PSpec Name="Check Dir Path">
				<PSpecID>6117</PSpecID>
				<LName>SMB Check Directory Path</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to determine if a directory exists at the server when a user executes a change directory command.</Desc>
				<CondExp><![CDATA[SMBCmd == 16]]></CondExp>
			</PSpec>
			<PSpec Name="Process Exit">
				<PSpecID>6118</PSpecID>
				<LName>SMB Process Exit</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent by the redirector to a server to terminate work within a connection. This session control command is sent for each active network path.</Desc>
				<CondExp><![CDATA[SMBCmd == 17]]></CondExp>
			</PSpec>
			<PSpec Name="Seek">
				<PSpecID>6119</PSpecID>
				<LName>SMB Seek</LName>
				<SName>SMB</SName>
				<Desc>Session Control Command sent to the server to move the file pointer.</Desc>
				<CondExp><![CDATA[SMBCmd == 18]]></CondExp>
			</PSpec>
			<PSpec Name="Lock Then Read Data">
				<PSpecID>6120</PSpecID>
				<LName>SMB Lock Then Read Data</LName>
				<SName>SMB</SName>
				<Desc>Message Command sent to the server to request that the server lock bytes and then read the locked bytes.</Desc>
				<CondExp><![CDATA[SMBCmd == 19]]></CondExp>
			</PSpec>
			<PSpec Name="Write Then Unlock Data">
				<PSpecID>6121</PSpecID>
				<LName>SMB Write Then Unlock Data</LName>
				<SName>SMB</SName>
				<Desc>Message Command sent to the server to request that the server write bytes and then unlock the bytes.</Desc>
				<CondExp><![CDATA[SMBCmd == 20]]></CondExp>
			</PSpec>
			<PSpec Name="Read Block Raw">
				<PSpecID>6122</PSpecID>
				<LName>SMB Read Block Raw</LName>
				<SName>SMB</SName>
				<Desc>The Read Block Raw protocol is used to maximize the performance of reading a large block of data from the server to the client. The Read Block Raw command&apos;s scope includes, but is not limited to, files, Named Pipes and communication devices.</Desc>
				<CondExp><![CDATA[SMBCmd == 26]]></CondExp>
			</PSpec>
			<PSpec Name="Read Block Multiplexed">
				<PSpecID>6123</PSpecID>
				<LName>SMB Read Block Multiplexed</LName>
				<SName>SMB</SName>
				<Desc>The Read Block Multiplexed protocol is used to maximize the performance of reading a large block of data from the server to the client on a multiplexed VC. The Read Block Multiplexed command&apos;s scope includes, but is not limited to, files, Named Pipes and communication devices.</Desc>
				<CondExp><![CDATA[SMBCmd == 27]]></CondExp>
			</PSpec>
			<PSpec Name="Read Block 2nd Rsp">
				<PSpecID>6124</PSpecID>
				<LName>SMB Read Block Secondary Response</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 28]]></CondExp>
			</PSpec>
			<PSpec Name="Write Block Raw">
				<PSpecID>6125</PSpecID>
				<LName>SMB Write Block Raw</LName>
				<SName>SMB</SName>
				<Desc>The Write Block Raw protocol is used to maximize the performance of writing a large block of data from the server to the client. The Write Block Raw command&apos;s scope includes, but is not limited to, files, Named Pipes, communication devices, printer devices and spooled output.</Desc>
				<CondExp><![CDATA[SMBCmd == 29]]></CondExp>
			</PSpec>
			<PSpec Name="Write Block Multiplexed">
				<PSpecID>6126</PSpecID>
				<LName>SMB Write Block Multiplexed</LName>
				<SName>SMB</SName>
				<Desc>The Write Block Multiplexed protocol is used to maximize the performance of writing a large block of data from the server to the client on a multiplexed VC. The Write Block Multiplexed command&apos;s scope includes, but is not limited to, files, Named Pipes, communication devices, printer devices and spooled output.</Desc>
				<CondExp><![CDATA[SMBCmd == 30]]></CondExp>
			</PSpec>
			<PSpec Name="Write Block 2nd Req">
				<PSpecID>6127</PSpecID>
				<LName>SMB Write Block Secondary Request</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 31]]></CondExp>
			</PSpec>
			<PSpec Name="Write Complete Rsp">
				<PSpecID>6128</PSpecID>
				<LName>SMB Write Complete Response</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 32]]></CondExp>
			</PSpec>
			<PSpec Name="Set File Attr Expand">
				<PSpecID>6129</PSpecID>
				<LName>SMB Set File Attributes Expanded</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message to accommodate a new OS/2 system call.</Desc>
				<CondExp><![CDATA[SMBCmd == 34]]></CondExp>
			</PSpec>
			<PSpec Name="Get File Attr Expand">
				<PSpecID>6130</PSpecID>
				<LName>SMB Get File Attributes Expanded</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message to accommodate a new OS/2 system call.</Desc>
				<CondExp><![CDATA[SMBCmd == 35]]></CondExp>
			</PSpec>
			<PSpec Name="Lock Byte Ranges &amp; X">
				<PSpecID>6131</PSpecID>
				<LName>SMB Lock/Unlock Byte Ranges and X</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message to accommodate a new OS/2 system call to lock byte ranges and then execute another valid protocol request, e.g. CLOSE.</Desc>
				<CondExp><![CDATA[SMBCmd == 36]]></CondExp>
			</PSpec>
			<PSpec Name="Xact Name, Bytes In/Out">
				<PSpecID>6132</PSpecID>
				<LName>SMB Transaction - Name, Bytes In/Out</LName>
				<SName>SMB</SName>
				<Desc>The Transaction protocol performs a symbolically-named transaction. This transaction is known only by a name (no file handle is used). The Transaction command&apos;s scope includes, but is not limited to, Named Pipes and Mail Slots.</Desc>
				<CondExp><![CDATA[SMBCmd == 37]]></CondExp>
			</PSpec>
			<PSpec Name="Transaction 2nd">
				<PSpecID>6133</PSpecID>
				<LName>SMB Transaction (Secondary Request/Response)</LName>
				<SName>SMB</SName>
				<Desc>The Transaction protocol performs a symbolically-named transaction. This transaction is known only by a name (no file handle is used). The Transaction command&apos;s scope includes, but is not limited to, Named Pipes and Mail Slots.</Desc>
				<CondExp><![CDATA[SMBCmd == 38]]></CondExp>
			</PSpec>
			<PSpec Name="IOCTL">
				<PSpecID>6134</PSpecID>
				<LName>SMB Input Output Control</LName>
				<SName>SMB</SName>
				<Desc>The Transaction protocol performs a symbolically-named transaction. This transaction is known only by a name (no file handle is used). The Transaction command&apos;s scope includes, but is not limited to, Named Pipes and Mail Slots.</Desc>
				<CondExp><![CDATA[SMBCmd == 39]]></CondExp>
			</PSpec>
			<PSpec Name="IOCTL 2nd">
				<PSpecID>6135</PSpecID>
				<LName>SMB Input Output Control (Secondary Request/Response)</LName>
				<SName>SMB</SName>
				<Desc>The Transaction protocol performs a symbolically-named transaction. This transaction is known only by a name (no file handle is used). The Transaction command&apos;s scope includes, but is not limited to, Named Pipes and Mail Slots.</Desc>
				<CondExp><![CDATA[SMBCmd == 40]]></CondExp>
			</PSpec>
			<PSpec Name="Copy">
				<PSpecID>6136</PSpecID>
				<LName>SMB Copy</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message used when both the source and target device are remote.</Desc>
				<CondExp><![CDATA[SMBCmd == 41]]></CondExp>
			</PSpec>
			<PSpec Name="Move">
				<PSpecID>6137</PSpecID>
				<LName>SMB Move</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message used when both the source and target device are remote.</Desc>
				<CondExp><![CDATA[SMBCmd == 42]]></CondExp>
			</PSpec>
			<PSpec Name="Echo">
				<PSpecID>6138</PSpecID>
				<LName>SMB Echo</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message used to echo data that has been sent back to the source node.</Desc>
				<CondExp><![CDATA[SMBCmd == 43]]></CondExp>
			</PSpec>
			<PSpec Name="Write &amp; Close">
				<PSpecID>6139</PSpecID>
				<LName>SMB Write And Close</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message to write the final bytes of a message and then close a file.</Desc>
				<CondExp><![CDATA[SMBCmd == 44]]></CondExp>
			</PSpec>
			<PSpec Name="Open &amp; X">
				<PSpecID>6140</PSpecID>
				<LName>SMB Open And X</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message used to Open a file and then execute another valid protocol request, e.g. READ.</Desc>
				<CondExp><![CDATA[SMBCmd == 45]]></CondExp>
			</PSpec>
			<PSpec Name="Read &amp; X">
				<PSpecID>6141</PSpecID>
				<LName>SMB Read And X</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message used to Read a file and then execute another valid protocol request, e.g. CLOSE.</Desc>
				<CondExp><![CDATA[SMBCmd == 46]]></CondExp>
			</PSpec>
			<PSpec Name="Write &amp; X">
				<PSpecID>6142</PSpecID>
				<LName>SMB Write And X</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message used to Write a file and then execute another valid protocol request, e.g. READ.</Desc>
				<CondExp><![CDATA[SMBCmd == 47]]></CondExp>
			</PSpec>
			<PSpec Name="Xact2 Function, Byte In/Out">
				<PSpecID>6143</PSpecID>
				<LName>SMB Transaction2 - Function, Byte Input/Output</LName>
				<SName>SMB</SName>
				<Desc>The Transaction protocol performs a symbolically-named transaction. This transaction is known only by a name (no file handle is used). The Transaction command&apos;s scope includes, but is not limited to, Named Pipes and Mail Slots.</Desc>
				<CondExp><![CDATA[SMBCmd == 50]]></CondExp>
			</PSpec>
			<PSpec Name="Transaction2 2nd">
				<PSpecID>6144</PSpecID>
				<LName>SMB Transaction2 (Secondary Request/Response)</LName>
				<SName>SMB</SName>
				<Desc>The Transaction protocol performs a symbolically-named transaction. This transaction is known only by a name (no file handle is used). The Transaction command&apos;s scope includes, but is not limited to, Named Pipes and Mail Slots.</Desc>
				<CondExp><![CDATA[SMBCmd == 51]]></CondExp>
			</PSpec>
			<PSpec Name="Find Close 2">
				<PSpecID>6145</PSpecID>
				<LName>SMB Find Close 2</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 52]]></CondExp>
			</PSpec>
			<PSpec Name="Find Notify Close">
				<PSpecID>6146</PSpecID>
				<LName>SMB Find Notify Close</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 53]]></CondExp>
			</PSpec>
			<PSpec Name="Tree Conn">
				<PSpecID>6147</PSpecID>
				<LName>SMB Tree Connect</LName>
				<SName>SMB</SName>
				<Desc>The Tree Connect Protocol is used to define the directory (tree) or other resource s available to the user. On receiving the Tree Connect protocol, the serving node verifies the name, password combination, and returns an error code or an identifier (the TID).</Desc>
				<CondExp><![CDATA[SMBCmd == 112]]></CondExp>
			</PSpec>
			<PSpec Name="Tree Disconn">
				<PSpecID>6148</PSpecID>
				<LName>SMB Tree Disconnect</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 113]]></CondExp>
			</PSpec>
			<PSpec Name="Negotiate Protocol">
				<PSpecID>6149</PSpecID>
				<LName>SMB Negotiate Protocol</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 114]]></CondExp>
			</PSpec>
			<PSpec Name="Sess Set Up And X">
				<PSpecID>6150</PSpecID>
				<LName>SMB Session Set Up &amp; X (Including User Logon)</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message used to start up a session and then execute another valid protocol request.</Desc>
				<CondExp><![CDATA[SMBCmd == 115]]></CondExp>
			</PSpec>
			<PSpec Name="User Logoff &amp; X">
				<PSpecID>6151</PSpecID>
				<LName>SMB User Logoff And X</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message used to terminate a session, log off and then execute another valid protocol request.</Desc>
				<CondExp><![CDATA[SMBCmd == 116]]></CondExp>
			</PSpec>
			<PSpec Name="Tree Conn &amp; X">
				<PSpecID>6152</PSpecID>
				<LName>SMB Tree Connect And X</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 117]]></CondExp>
			</PSpec>
			<PSpec Name="Get Server Attr">
				<PSpecID>6153</PSpecID>
				<LName>SMB Get Server Attributes</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 128]]></CondExp>
			</PSpec>
			<PSpec Name="Search Directory">
				<PSpecID>6154</PSpecID>
				<LName>SMB Search Directory</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 129]]></CondExp>
			</PSpec>
			<PSpec Name="Find First">
				<PSpecID>6155</PSpecID>
				<LName>SMB Find First</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message that matches the OS/2 form of FILESEARCH. The Find protocol finds the directory entry or group of entries matching the specified file pathname. This protocol may be used in place of the core &apos;Search&apos; protocol.</Desc>
				<CondExp><![CDATA[SMBCmd == 130]]></CondExp>
			</PSpec>
			<PSpec Name="Find Unique">
				<PSpecID>6156</PSpecID>
				<LName>SMB Find Unique</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message that matches the OS/2 form of FILESEARCH. The Find protocol finds the directory entry or group of entries matching the specified file pathname. This protocol may be used in place of the core &apos;Search&apos; protocol.</Desc>
				<CondExp><![CDATA[SMBCmd == 131]]></CondExp>
			</PSpec>
			<PSpec Name="Find Close">
				<PSpecID>6157</PSpecID>
				<LName>SMB Find Close</LName>
				<SName>SMB</SName>
				<Desc>SMB File Sharing Protocol Extension message that matches the OS/2 form of FILESEARCH. The Find protocol finds the directory entry or group of entries matching the specified file pathname. This protocol may be used in place of the core &apos;Search&apos; protocol.</Desc>
				<CondExp><![CDATA[SMBCmd == 132]]></CondExp>
			</PSpec>
			<PSpec Name="NT Transaction">
				<PSpecID>6172</PSpecID>
				<LName>NT Transaction</LName>
				<SName>SMB</SName>
				<Desc>The functions supported by NT Transaction are not defined by the transaction sub-protocol. The transaction protocol simply provides a means of delivering them and retrieving the results.</Desc>
				<CondExp><![CDATA[SMBCmd == 160]]></CondExp>
			</PSpec>
			<PSpec Name="NT Create and X">
				<PSpecID>6170</PSpecID>
				<LName>NT Create and X</LName>
				<SName>SMB</SName>
				<Desc>The NT Create and X command is used to create or open a file or a directory.</Desc>
				<CondExp><![CDATA[SMBCmd == 162]]></CondExp>
			</PSpec>
			<PSpec Name="NT Cancel">
				<PSpecID>6171</PSpecID>
				<LName>NT Cancel</LName>
				<SName>SMB</SName>
				<Desc>The NT Cancel command allows a client to cancel a request currently pending at the server.</Desc>
				<CondExp><![CDATA[SMBCmd == 164]]></CondExp>
			</PSpec>
			<PSpec Name="Open Print Spool File">
				<PSpecID>6158</PSpecID>
				<LName>SMB Open Print Spool File</LName>
				<SName>SMB</SName>
				<Desc>Print Command sent by the redirector to the server to set up a data stream in which to spool print data.</Desc>
				<CondExp><![CDATA[SMBCmd == 192]]></CondExp>
			</PSpec>
			<PSpec Name="Write To Print Spool File">
				<PSpecID>6159</PSpecID>
				<LName>SMB Write To Print Spool File</LName>
				<SName>SMB</SName>
				<Desc>Print Command sent by the redirector to the server to spool a block of data from a file. The first block sent contains set-up information for the printer.</Desc>
				<CondExp><![CDATA[SMBCmd == 193]]></CondExp>
			</PSpec>
			<PSpec Name="Close Print Spool File">
				<PSpecID>6160</PSpecID>
				<LName>SMB Close Print Spool File</LName>
				<SName>SMB</SName>
				<Desc>Print Command sent by the redirector to the server to close a print spool. The server then queues the file for printing.</Desc>
				<CondExp><![CDATA[SMBCmd == 194]]></CondExp>
			</PSpec>
			<PSpec Name="Return Print Queue">
				<PSpecID>6161</PSpecID>
				<LName>SMB Return Print Queue</LName>
				<SName>SMB</SName>
				<Desc>Print Command sent by the redirector to the server to return the contents of the server print queue.</Desc>
				<CondExp><![CDATA[SMBCmd == 195]]></CondExp>
			</PSpec>
			<PSpec Name="Send Single Block Msg">
				<PSpecID>6162</PSpecID>
				<LName>SMB Send Single Block Message</LName>
				<SName>SMB</SName>
				<Desc>Message Command sent from one redirector to another. The short (single block) message consists of a maximum of 128 characters.</Desc>
				<CondExp><![CDATA[SMBCmd == 208]]></CondExp>
			</PSpec>
			<PSpec Name="Send Broadcast Msg">
				<PSpecID>6163</PSpecID>
				<LName>SMB Send Broadcast Message</LName>
				<SName>SMB</SName>
				<Desc>Sends a short message to all receivers on the network. A broadcast message is sent as a datagram, so there are no responses from the receivers.</Desc>
				<CondExp><![CDATA[SMBCmd == 209]]></CondExp>
			</PSpec>
			<PSpec Name="Forward User Name">
				<PSpecID>6164</PSpecID>
				<LName>SMB Forward User Name</LName>
				<SName>SMB</SName>
				<Desc>Message Command sent to the server to request that the server receive messages for an additional user name. There must be room in the server&apos;s table to add a new name in order for this request to be fulfilled.</Desc>
				<CondExp><![CDATA[SMBCmd == 210]]></CondExp>
			</PSpec>
			<PSpec Name="Cancel Forward">
				<PSpecID>6165</PSpecID>
				<LName>SMB Cancel Forward</LName>
				<SName>SMB</SName>
				<Desc>Message Command sent to the server to request that the server delete a user name from its table.</Desc>
				<CondExp><![CDATA[SMBCmd == 211]]></CondExp>
			</PSpec>
			<PSpec Name="Get Machine Name">
				<PSpecID>6166</PSpecID>
				<LName>SMB Get Machine Name</LName>
				<SName>SMB</SName>
				<Desc>Message Command sent to obtain the machine name for a specified user name. This command is usually used in conjunction with the CANCEL FORWARD Command in order to get a name to which the CANCEL FORWARD Command will be sent.</Desc>
				<CondExp><![CDATA[SMBCmd == 212]]></CondExp>
			</PSpec>
			<PSpec Name="Send SOMB Msg">
				<PSpecID>6167</PSpecID>
				<LName>SMB Send Start Of Multi-Block Message</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 213]]></CondExp>
			</PSpec>
			<PSpec Name="Send EOMB Msg">
				<PSpecID>6168</PSpecID>
				<LName>SMB Send End Of Multi-Block Message</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 214]]></CondExp>
			</PSpec>
			<PSpec Name="Send TOMB Msg">
				<PSpecID>6169</PSpecID>
				<LName>SMB Send Text Of Multi-Block Message</LName>
				<SName>SMB</SName>
				<Desc>Server Message Blocks (SMB) represent the core protocols used for remote file services under NetBIOS and LAN Manager. These protocols are designed to allow systems to transparently access files which reside on remotes systems, including foreign operating systems.</Desc>
				<CondExp><![CDATA[SMBCmd == 215]]></CondExp>
			</PSpec>
		</PSpec>
	</PSpec>
	<PSpec Name="TCP/UDP NetBIOS Children" Type="CommonTable">
		<NotChild Name="IP//IPv6"/>
		<Definitions>
			<Define>
				<Name>NBType</Name>
				<Value><![CDATA[MLD8[0]]]></Value>
			</Define>
		</Definitions>
		<PSpec Name="SessMsg">
			<PSpecID>1438</PSpecID>
			<LName>Session Message</LName>
			<SName>NB SessMsg</SName>
			<Desc>The NetBIOS session service begins after one or more IP addresses have been found for the target name. These addresses may have been acquired using the NetBIOS name query transactions or by other means, such as a local name table or cache. NetBIOS session service transactions, packets, and protocols are identical for all endnode types. They involve only directed (point-to-point) communications.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 0]]></CondExp>
			<NextLayer>
				<Exp><![CDATA[     4     ]]></Exp>
			</NextLayer>
			<Link Name="NetBIOS SMB"/>
		</PSpec>
		<PSpec Name="DU Dgram">
			<PSpecID>1431</PSpecID>
			<LName>Direct Unique Datagram</LName>
			<SName>NB DU Dgram</SName>
			<Desc>Every NetBIOS datagram has a named destination and source. To transmit a NetBIOS datagram, the datagram service must perform a name query operation to learn the IP address and the attributes of the destination NetBIOS name. This information may be cached to avoid the overhead of name query on subsequent NetBIOS datagrams. A Direct Unique datagram is sent when the name query is directed to one unique endnode.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 16]]></CondExp>
			<NextLayer>
				<Exp><![CDATA[     82     ]]></Exp>
			</NextLayer>
			<Link Name="NetBIOS SMB"/>
		</PSpec>
		<PSpec Name="DG Dgram">
			<PSpecID>1432</PSpecID>
			<LName>Direct Group Datagram</LName>
			<SName>NB DG Dgram</SName>
			<Desc>Every NetBIOS datagram has a named destination and source. To transmit a NetBIOS datagram, the datagram service must perform a name query operation to learn the IP address and the attributes of the destination NetBIOS name. This information may be cached to avoid the overhead of name query on subsequent NetBIOS datagrams. A Direct Group datagram is sent when the name query is directed to a specific group of endnodes.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 17]]></CondExp>
			<NextLayer>
				<Exp><![CDATA[     82     ]]></Exp>
			</NextLayer>
			<Link Name="NetBIOS SMB"/>
		</PSpec>
		<PSpec Name="Bcast Dgram">
			<PSpecID>1433</PSpecID>
			<LName>Broadcast Datagram</LName>
			<SName>NB BC Dgram</SName>
			<Desc>Every NetBIOS datagram has a named destination and source. To transmit a NetBIOS datagram, the datagram service must perform a name query operation to learn the IP address and the attributes of the destination NetBIOS name. This information may be cached to avoid the overhead of name query on subsequent NetBIOS datagrams. A Broadcast Datagram is sent when the name query is directed to all endnodes.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 18]]></CondExp>
		</PSpec>
		<PSpec Name="Dgram Err">
			<PSpecID>1434</PSpecID>
			<LName>Datagram Error</LName>
			<SName>NB Err</SName>
			<Desc>Endnodes may receive NetBIOS datagrams addressed to names not held by the receiving node. Such datagrams should be discarded. If the name is unique, then a DATAGRAM ERROR packet is sent to the source of that NetBIOS datagram.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 19]]></CondExp>
		</PSpec>
		<PSpec Name="Query Req">
			<PSpecID>1435</PSpecID>
			<LName>Datagram Query Request</LName>
			<SName>NB QryReq</SName>
			<Desc>Every NetBIOS datagram has a named destination and source. To transmit a NetBIOS datagram, the datagram service must perform a name query operation to learn the IP address and the attributes of the destination NetBIOS name. This information may be cached to avoid the overhead of name query on subsequent NetBIOS datagrams.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 20]]></CondExp>
		</PSpec>
		<PSpec Name="Pos Query Rsp">
			<PSpecID>1436</PSpecID>
			<LName>Datagram Positive Query Response</LName>
			<SName>NB PQRsp</SName>
			<Desc>Datagram Service packet sent when there is a positive response to a name query request.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 21]]></CondExp>
		</PSpec>
		<PSpec Name="Neg Query Rsp">
			<PSpecID>1437</PSpecID>
			<LName>Datagram Negative Query Response</LName>
			<SName>NB NQRsp</SName>
			<Desc>Datagram Service packet sent when there is a negative response to a name query request.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 22]]></CondExp>
		</PSpec>
		<PSpec Name="Sess Req">
			<PSpecID>1439</PSpecID>
			<LName>Session Request</LName>
			<SName>NB SessReq</SName>
			<Desc>Session service packet generated when a request to start a session is made.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 129]]></CondExp>
		</PSpec>
		<PSpec Name="Pos Sess Rsp">
			<PSpecID>1440</PSpecID>
			<LName>Positive Session Response</LName>
			<SName>NB PSesRsp</SName>
			<Desc>Session service packet generated when a positive response is returned to a Session Request datagram.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 130]]></CondExp>
		</PSpec>
		<PSpec Name="Neg Sess Rsp">
			<PSpecID>1441</PSpecID>
			<LName>Negative Session Response</LName>
			<SName>NB NSesRsp</SName>
			<Desc>Session service packet generated when a negative response is returned to a Session Request datagram.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 131]]></CondExp>
		</PSpec>
		<PSpec Name="Retarg Sess Rsp">
			<PSpecID>1442</PSpecID>
			<LName>Retarget Session Response</LName>
			<SName>NB RSesRsp</SName>
			<Desc>Session service packet generated when redirecting a response to a Session Request datagram.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 132]]></CondExp>
		</PSpec>
		<PSpec Name="Keep Alive">
			<PSpecID>1443</PSpecID>
			<LName>Session Keep Alive</LName>
			<SName>NB KeepAlive</SName>
			<Desc>During the steady-state phase of a NetBIOS session, data messages are exchanged. Keep-alive packets may also be exchanged to maintain the session connection if the participating nodes are so configured.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[NBType == 133]]></CondExp>
		</PSpec>
	</PSpec>
	<PSpec Name="XNS Children" Type="CommonTable">
		<PSpec Name="RIP">
			<PSpecID>4001</PSpecID>
			<LName>XNS Routing Information Protocol</LName>
			<SName>XNS RIP</SName>
			<Desc>The routing of internetwork packets as datagrams through the internetwork is performed using a store-and-forward algorithm that makes use of a routing table in the router of each system element. The Routing Information Protocol is the means by which this database is dynamically maintained, and, therefore, the means by which routers locate internetwork routes to other networks. The contents of a Routing Information Protocol packet will be one or more tuples, each of which consists of a 32-bit Object Network number and a 16-bit Internetwork Delay in hops.</Desc>
			<Color>color_1</Color>
			<CondExp><![CDATA[MLD8[5] == 0x01]]></CondExp>
		</PSpec>
		<PSpec Name="ECHO">
			<PSpecID>4002</PSpecID>
			<LName>XNS Echo Protocol</LName>
			<SName>XNS ECHO</SName>
			<Desc>The Echo Protocol is used to verify the existence and correct operation of a host and the path to it. This simple protocol specifies that all Echo Protocol packets received should be returned to the source.</Desc>
			<Color>color_2</Color>
			<CondExp><![CDATA[MLD8[5] == 0x02]]></CondExp>
		</PSpec>
		<PSpec Name="ERROR">
			<PSpecID>4003</PSpecID>
			<LName>XNS Error Protocol</LName>
			<SName>XNS ERR</SName>
			<Desc>The Error Protocol provides a means for any agent in the system to report that it has noticed an error and, as a result, has discarded the packet. The use of the protocol is optional, and is intended as a diagnostic tool as well as a means to improve performance. An Error Protocol packet is returned from the destination socket in the host detecting the error. If the Error Protocol packet is generated on behalf of the Internet Datagram Protocol package (by the router or internetwork router), then the source socket of this packet will be the well-known router error socket. Well-known socket numbers are assigned by Xerox Corporation, and socket numbers range from 1 to 3000. An Error Protocol packet is not generated in response to a broadcast or multicast packet in routers except internetwork routers that are forwarding a directed broadcast or multicast.</Desc>
			<Color>color_3</Color>
			<CondExp><![CDATA[MLD8[5] == 0x03]]></CondExp>
		</PSpec>
		<PSpec Name="PEP">
			<PSpecID>4004</PSpecID>
			<LName>XNS Packet Exchange Protocol</LName>
			<SName>XNS PEP</SName>
			<Desc>The Packet Exchange Protocol is used to transmit a request in a packet and receive a response with reliability greater than that achievable by transmitting internetwork packets directly as datagrams, and less that achievable through use of the Sequenced Packet Protocol. This simple protocol is &apos;single-packet&apos; oriented, and assumes that the client is capable of dealing with this level of unreliability. This protocol retransmits a request, but does not perform any duplicate detection: it is suitable in applications where the request/response transactions are idempotent (unchanged when multiplied by themselves), or where the communicating clients are capable of providing the necessary level of reliability through the very nature of their application and form of interaction. Packet Exchange Protocol packets may be sourced from or destined for any socket.</Desc>
			<Color>color_4</Color>
			<CondExp><![CDATA[MLD8[5] == 0x04]]></CondExp>
		</PSpec>
		<PSpec Name="SPP">
			<PSpecID>4005</PSpecID>
			<LName>XNS Sequenced Packet Protocol</LName>
			<SName>XNS SPP</SName>
			<Desc>The Sequenced Packet Protocol provides reliable transmission of successive internetwork packets for client processes. Each of the client&apos;s packets is given a sequence number when it is transmitted. These sequence numbers are used to order the packets, to detect and suppress duplicates, and, when returned to the source, to acknowledge receipt of the packets. The flow of data from the sender to the receiver is controlled on a packet basis. The source may transmit packets having sequence numbers up to and including the number specified by the receiver. This protocol encourages the maximum size of a packet to be 576 bytes. Client processes may negotiate use of a different maximum size when opening a connection. In an acknowledging protocol such as this one, the recipient of a packet has to decide whether to acknowledge a lone packet or to wait and acknowledge several at once. In order to facilitate this decision, the source is given the option of specifying that it wants an immediate acknowledgment.</Desc>
			<Color>color_10</Color>
			<CondExp><![CDATA[MLD8[5] == 0x05]]></CondExp>
		</PSpec>
	</PSpec>
	<PSpec Name="AppleTalk DDP" Type="CommonTable">
		<PSpec Name="RTMP">
			<PSpecID>7101</PSpecID>
			<LName>Routing Table Maintenance Protocol</LName>
			<SName>RTMP</SName>
			<Desc>RTMP packets are used by AppleTalk routers and other nodes on an AppleTalk network to acquire and update routing information. RTMP allows an AppleTalk internet to dynamically discover and propagate changes to the network configuration.</Desc>
			<Color>color_3</Color>
			<CondExp><![CDATA[(MLD8[-1] == 0x01) || (MLD8[-1] == 0x05)]]></CondExp>
			<PSpec Name="Request">
				<PSpecID>7103</PSpecID>
				<LName>Routing Table Maintenance Protocol Request</LName>
				<SName>RTMP Request</SName>
				<Desc>RTMP Request packets are sent out by nodes on the AppleTalk network who are trying to discover the number of the network on which they are located.</Desc>
				<CondExp><![CDATA[MLD8[-1] == 0x05]]></CondExp>
			</PSpec>
			<PSpec Name="Data">
				<PSpecID>7102</PSpecID>
				<LName>Routing Table Maintenance Protocol Data</LName>
				<SName>RTMP Data</SName>
				<Desc>RTMP Data packets are usually sent out periodically by routers, or sent out as a response to a RTMP Request. These packets contain networks known to the router, the range of network numbers for a given segment and the distance (number of routers) a segment occurs from the router transmitting the RTMP data packet.</Desc>
				<CondExp><![CDATA[MLD8[-1] == 0x01]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="NBP">
			<PSpecID>7104</PSpecID>
			<LName>Name Binding Protocol</LName>
			<SName>NBP</SName>
			<Desc>NBP packets are used to discover the names of available services or nodes on an AppleTalk network and then associate an AppleTalk address (net and node number) to that name.</Desc>
			<Color>color_4</Color>
			<CondExp><![CDATA[MLD8[-1] == 0x02]]></CondExp>
			<PSpec Name="BrRq">
				<PSpecID>7105</PSpecID>
				<LName>Name Binding Protocol Broadcast Request</LName>
				<SName>NBP BrRq</SName>
				<Desc>NBP lookups are a request for a list of service providers, their names, and their addresses. The packet is first sent to a router, if available, and then the router will broadcast or forward the packet on the AppleTalk internet as appropriate. On networks with no router, the packet will be broadcast directly.</Desc>
				<CondExp><![CDATA[(MLD8[0] & 0xf0) == 0x10]]></CondExp>
			</PSpec>
			<PSpec Name="Lookup">
				<PSpecID>7106</PSpecID>
				<LName>Name Binding Protocol Lookup</LName>
				<SName>NBP Lookup</SName>
				<Desc>NBP lookups are a request for a list of service providers, their names, and their addresses.</Desc>
				<CondExp><![CDATA[(MLD8[0] & 0xf0) == 0x20]]></CondExp>
			</PSpec>
			<PSpec Name="Reply">
				<PSpecID>7107</PSpecID>
				<LName>Name Binding Protocol Reply</LName>
				<SName>NBP Reply</SName>
				<Desc>As a response to an NBP Lookup, an NBP Reply contains the name and address of a service provided by some node on the AppleTalk network.</Desc>
				<CondExp><![CDATA[(MLD8[0] & 0xf0) == 0x30]]></CondExp>
			</PSpec>
			<PSpec Name="FwdReq">
				<PSpecID>7108</PSpecID>
				<LName>Name Binding Protocol Forward Request</LName>
				<SName>NBP FwdReq</SName>
				<Desc>When an NBP Broadcast Request is sent to a router and that router recognizes that it is not directly attached to the network on which the request should be made the router sends an NBP Forward Request packet to send the request to the appropriate router.</Desc>
				<CondExp><![CDATA[(MLD8[0] & 0xf0) == 0x40]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="ATP">
			<PSpecID>7109</PSpecID>
			<LName>AppleTalk Transaction Protocol</LName>
			<SName>ATP</SName>
			<Desc>DDP is a best-effort datagram delivery service, hence is known as an unreliable or non-guaranteed service. ATP is a reliable delivery service that uses DDP. Once a connection is made between to nodes, ATP will monitor the connection, retransmit as necessary, and notify the user if the connection fails. It is typically used for services like file servers and printing.</Desc>
			<Color>color_5</Color>
			<CondExp><![CDATA[MLD8[-1] == 0x03]]></CondExp>
			<PSpec Name="TReq">
				<PSpecID>7110</PSpecID>
				<LName>AppleTalk Transaction Protocol - Transaction Request</LName>
				<SName>ATP TReq</SName>
				<Desc>In order to guarantee delivery of packets, ATP uses a request, followed by one or more responses, possibly followed by another request with one or more responses, repeating until ultimately an ATP release packet is sent.</Desc>
				<CondExp><![CDATA[(MLD8[0] & 0xc0) == 0x40]]></CondExp>
				<PSpec Name="ZIP">
					<PSpecID>7139</PSpecID>
					<LName>Zone Information Protocol</LName>
					<SName>AT ZIP</SName>
					<Desc>On a large AppleTalk internet, there may be many nodes and services which can make using the Name Binding Protocol slow and cumbersome to use. The Zone Information Protocol is a way to arbitrarily divide the internet into zones so that the scope of the NBP operations can be limited to the areas of interest. Zone information is maintained by AppleTalk routers on the internet. A zone is comprised of a set of one or more network numbers.</Desc>
					<Color>color_9</Color>
					<CondExp><![CDATA[MLD8[-3] == 0x06]]></CondExp>
					<PSpec Name="GetZoneList">
						<PSpecID>7132</PSpecID>
						<LName>AppleTalk Transaction Protocol - GetZoneList</LName>
						<SName>ATP GZL</SName>
						<Desc>GetZoneList is used to obtain a complete list of zones available on the AppleTalk internet. The request is made by a node to an AppleTalk router. GetZoneList is part of the Zone Information protocol, but is placed under ATP in order to get guaranteed delivery of the request and responses.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x08]]></CondExp>
					</PSpec>
					<PSpec Name="GetLocalZones">
						<PSpecID>7133</PSpecID>
						<LName>AppleTalk Transaction Protocol - GetLocalZones</LName>
						<SName>ATP GLZ</SName>
						<Desc>GetLocalZones is used to obtain a list of zones available on the network to which the requester is attached. The request is made by a node to an AppleTalk router. GetLocalZones is part of the Zone Information protocol, but is placed under ATP in order to get guaranteed delivery of the request and responses.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x09]]></CondExp>
					</PSpec>
					<PSpec Name="GetMyZone">
						<PSpecID>7134</PSpecID>
						<LName>AppleTalk Transaction Protocol - GetMyZone</LName>
						<SName>ATP GMZ</SName>
						<Desc>GetMyZone is used to obtain the name of the zone in which the requesting node is located (nonextended networks only). The request is made by a node to an AppleTalk router. GetMyZone is part of the Zone Information protocol, but is placed under ATP in order to get guaranteed delivery of the request and responses.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x07]]></CondExp>
					</PSpec>
				</PSpec>
				<PSpec Name="ASP">
					<PSpecID>7123</PSpecID>
					<LName>AppleTalk Session Protocol</LName>
					<SName>AT ASP</SName>
					<Desc>ASP adds higher level transport functions to ATP. Inherent to ASP is the concept of a Session which is a logical connection between a server and a client. In general, commands are issued by the client to the server and the server issues responses. However, an ASP server can also initiate an Attention which informs the client that the server needs attention. ASP is used by AFP, the protocol which implements Apple File Sharing. Many ASP command replies do not identify themselves as such and hence are not identifiable without further analysis of other packets in the transaction. The protocol type of these packets is therefore only shown as ATP TRsp.</Desc>
					<Color>color_14</Color>
					<CondExp><![CDATA[  ((MLD32[4] & 0xff00ffff) == 0x01000000) || (MLD8[4] == 0x02) || (MLD32[4] == 0x03000000) || (MLD8[4] == 0x04) || ((MLD32[4] & 0xff00ffff) == 0x05000000) || (MLD8[4] == 0x06) || (MLD8[4] == 0x07) || (MLD8[4] == 0x08)    ]]></CondExp>
					<PSpec Name="CloseSess">
						<PSpecID>7124</PSpecID>
						<LName>AppleTalk Session Protocol - Close Session</LName>
						<SName>ASP CloseSess</SName>
						<Desc>The ASP CloseSession and CloseSessionReply are used to terminate an ASP session between the server and the client. Either party may initiate the termination.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x01]]></CondExp>
					</PSpec>
					<PSpec Name="Command">
						<PSpecID>7125</PSpecID>
						<LName>AppleTalk Session Protocol - Command</LName>
						<SName>ASP Cmd</SName>
						<Desc>An ASP command is the normal way that an ASP client initiates communication with a server in the communication session. Many ASP command replies do not identify themselves as such and hence are not identifiable without further analysis of other packets in the transaction. The protocol type of these packets is therefore only shown as ATP TRsp.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x02]]></CondExp>
					</PSpec>
					<PSpec Name="GetStatus">
						<PSpecID>7126</PSpecID>
						<LName>AppleTalk Session Protocol - GetStatus</LName>
						<SName>ASP GetStatus</SName>
						<Desc>The ASP GetStatus command allows the client to get information about an ASP server without opening a session with it.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x03]]></CondExp>
					</PSpec>
					<PSpec Name="OpenSess">
						<PSpecID>7127</PSpecID>
						<LName>AppleTalk Session Protocol - Open Session</LName>
						<SName>ASP OpenSess</SName>
						<Desc>Data can be exchanged between a ASP server and client only after a connection has been established by using ASP OpenSession. In the OpenSession and OpenSessionReply sequence, each process must discover the address of the ATP responding socket which will be used to exchange data and also determine the maximum amount of data that can be handled by each end of the session so that each may optimize the size of their command and replies.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x04]]></CondExp>
					</PSpec>
					<PSpec Name="Tickle">
						<PSpecID>7128</PSpecID>
						<LName>AppleTalk Session Protocol - Tickle</LName>
						<SName>ASP Tickle</SName>
						<Desc>A session remains open until it is explicitly terminated by either end of the session. ASP Tickle packets commence as soon as a session is open. Each end sends Tickle packets to the other to tell that it is functioning properly. If either end fails to receive a Tickle packet for a predetermined period of time, it assumes that the other end has gone down and the session times out and closes.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x05]]></CondExp>
					</PSpec>
					<PSpec Name="Write">
						<PSpecID>7129</PSpecID>
						<LName>AppleTalk Session Protocol - Write</LName>
						<SName>ASP Write</SName>
						<Desc>The ASP Write and WriteContinue are used to convey data between the server and the client. Up to eight response packets can be sent in reply to a Write or WriteContinue command.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x06]]></CondExp>
					</PSpec>
					<PSpec Name="WriteContinue">
						<PSpecID>7130</PSpecID>
						<LName>AppleTalk Session Protocol - WriteContinue</LName>
						<SName>ASP WriteCont</SName>
						<DescID>7129</DescID>
						<CondExp><![CDATA[MLD8[4] == 0x07]]></CondExp>
					</PSpec>
					<PSpec Name="Attention">
						<PSpecID>7131</PSpecID>
						<LName>AppleTalk Session Protocol - Attention</LName>
						<SName>ASP Attn</SName>
						<Desc>The sole purpose of this command is to have the server alert the client of the server&apos;s need of attention. Normally, upon receiving the attention command, the client will issue commands to find out the details in the change in status.</Desc>
						<CondExp><![CDATA[MLD8[4] == 0x08]]></CondExp>
					</PSpec>
				</PSpec>
				<PSpec Name="PAP">
					<PSpecID>7113</PSpecID>
					<LName>Printer Access Protocol</LName>
					<SName>PAP</SName>
					<Desc>PAP is a session-level protocol that enables communication between workstations and servers. As a connection-oriented protocol, it handles set up, closing, data transfer and connection maintenance. It is typically used in AppleTalk to connect to laser printers, but may be used in other similar server-client situations.</Desc>
					<Color>color_6</Color>
					<CondExp><![CDATA[(MLD24[5] == 0x010000) || (MLD8[5] == 0x03) || (MLD24[5] == 0x050000) || (MLD24[5] == 0x060000) || (MLD32[4] == 0x00080000)]]></CondExp>
					<PSpec Name="OpenConn">
						<PSpecID>7114</PSpecID>
						<LName>Printer Access Protocol - Open Connection</LName>
						<SName>PAP OpenConn</SName>
						<Desc>Data can be exchanged between a PAP server and client only after a connection has been established by using PAP Open Connection. In the Open Connection and Open Reply sequence, each process must discover the address of the ATP responding socket which will be used to exchange data and also determine the maximum amount of data that can be exchanged in a single packet (flow quantum).</Desc>
						<CondExp><![CDATA[MLD8[5] == 0x01]]></CondExp>
					</PSpec>
					<PSpec Name="SendData">
						<PSpecID>7116</PSpecID>
						<LName>Printer Access Protocol - SendData</LName>
						<SName>PAP SendData</SName>
						<Desc>After a PAP connection is established, the Send and Data sequence is used in conjunction with the PAPRead to transfer data between the server and the client.</Desc>
						<CondExp><![CDATA[MLD8[5] == 0x03]]></CondExp>
					</PSpec>
					<PSpec Name="Tickle">
						<PSpecID>7118</PSpecID>
						<LName>Printer Access Protocol - Tickle</LName>
						<SName>PAP Tickle</SName>
						<Desc>On each side of a PAP connection there is a timer which is used to determine if one side of the PAP connection has closed unexpectedly or terminated. In the absence of data being transferred in the connection, Tickle packets are used to keep the connection active (alive) on both ends.</Desc>
						<CondExp><![CDATA[MLD8[5] == 0x05]]></CondExp>
					</PSpec>
					<PSpec Name="CloseConn">
						<PSpecID>7119</PSpecID>
						<LName>Printer Access Protocol - Close Connection</LName>
						<SName>PAP CloseConn</SName>
						<Desc>After a PAP connection has completed the transfer of data, as a courtesy the connection is closed and any pending ATP transactions, including Tickle transactions are canceled at both ends.</Desc>
						<CondExp><![CDATA[MLD8[5] == 0x06]]></CondExp>
					</PSpec>
					<PSpec Name="SendStatus">
						<PSpecID>7121</PSpecID>
						<LName>Printer Access Protocol - Send Status</LName>
						<SName>PAP SendStatus</SName>
						<Desc>A PAP SendStatus and Status Reply exchange can take place even if there has not been an Open Connection sequence. The status is a simple string which gives the server&apos;s status to the requester.</Desc>
						<CondExp><![CDATA[MLD8[5] == 0x08]]></CondExp>
					</PSpec>
				</PSpec>
			</PSpec>
			<PSpec Name="TRel">
				<PSpecID>7112</PSpecID>
				<LName>AppleTalk Transaction Protocol - Transaction Release</LName>
				<SName>ATP TRel</SName>
				<DescID>7110</DescID>
				<CondExp><![CDATA[(MLD8[0] & 0xc0) == 0xc0]]></CondExp>
			</PSpec>
			<PSpec Name="TRsp">
				<PSpecID>7111</PSpecID>
				<LName>AppleTalk Transaction Protocol - Transaction Response</LName>
				<SName>ATP TRsp</SName>
				<Desc>In order to guarantee delivery of packets, ATP uses a request, followed by one or more responses, possibly followed by another request with one or more responses, repeating until ultimately an ATP release packet is sent. Many higher-level protocols like ASP use ATP as an underlying protocol layer. However, many ASP command replies do not identify themselves as such and hence are not identifiable without further analysis of other packets in the transaction. The protocol type of these packets is therefore only shown as ATP TRsp.</Desc>
				<CondExp><![CDATA[(MLD8[0] & 0xc0) == 0x80]]></CondExp>
				<PSpec Name="ZIP">
					<PSpecID>7139</PSpecID>
					<Color>color_9</Color>
					<CondExp><![CDATA[MLD8[-2] == 0x06]]></CondExp>
					<PSpec Name="GetZoneReply">
						<PSpecID>7135</PSpecID>
						<LName>AppleTalk Transaction Protocol - GetZoneReply</LName>
						<SName>ATP GZR</SName>
						<Desc>GetZoneReply is used to deliver a list of one or more zone names as requested by a GetZoneList, a GetLocalZones or a GetMyZone request. The reply is made by an AppleTalk router to a node. GetZoneReply is part of the Zone Information protocol, but is placed under ATP in order to get guaranteed delivery of the request and responses.</Desc>
						<CondExp><![CDATA[MLD8[-2] == 0x06]]></CondExp>
					</PSpec>
				</PSpec>
				<PSpec Name="PAP">
					<PSpecID>7113</PSpecID>
					<Color>color_6</Color>
					<CondExp><![CDATA[(MLD24[5] == 0x020000) || (MLD8[5] == 0x04 && MLD8[7] == 0x00) || (MLD24[5] == 0x070000) || (MLD32[4] == 0x00090000)]]></CondExp>
					<PSpec Name="OpenConnReply">
						<PSpecID>7115</PSpecID>
						<LName>Printer Access Protocol - Open Connection Reply</LName>
						<SName>PAP OpenConnReply</SName>
						<DescID>7114</DescID>
						<CondExp><![CDATA[MLD8[5] == 0x02]]></CondExp>
					</PSpec>
					<PSpec Name="Data">
						<PSpecID>7117</PSpecID>
						<LName>Printer Access Protocol - Data</LName>
						<SName>PAP Data</SName>
						<DescID>7116</DescID>
						<CondExp><![CDATA[MLD8[5] == 0x04]]></CondExp>
					</PSpec>
					<PSpec Name="CloseConnReply">
						<PSpecID>7120</PSpecID>
						<LName>Printer Access Protocol - Close Connection Reply</LName>
						<SName>PAP CloseConnReply</SName>
						<DescID>7119</DescID>
						<CondExp><![CDATA[MLD8[5] == 0x07]]></CondExp>
					</PSpec>
					<PSpec Name="StatusReply">
						<PSpecID>7122</PSpecID>
						<LName>Printer Access Protocol - Status Reply</LName>
						<SName>PAP StatusReply</SName>
						<DescID>7121</DescID>
						<CondExp><![CDATA[MLD8[5] == 0x09]]></CondExp>
					</PSpec>
				</PSpec>
				<PSpec Name="ASP" Sort="Last">
					<PSpecID>7123</PSpecID>
					<Color>color_14</Color>
				</PSpec>
			</PSpec>
		</PSpec>
		<PSpec Name="AEP">
			<PSpecID>7136</PSpecID>
			<LName>AppleTalk Echo Protocol</LName>
			<SName>AT AEP</SName>
			<Desc>The AppleTalk Echo Protocol is used as a simple probe mechanism to test if a node is present on the AppleTalk internet. An Echo Request packet contains data which is sent to a receiving node. If the receiving node contains an Echoer, it will return an Echo Reply, with the same data returned. AEP is sometimes used to measure the round-trip time required to communicate between two nodes on the internet so that time-out values in reliable delivery service protocols can be set appropriately.</Desc>
			<Color>color_8</Color>
			<CondExp><![CDATA[MLD8[-1] == 0x04]]></CondExp>
			<PSpec Name="Request">
				<PSpecID>7137</PSpecID>
				<LName>AppleTalk Echo Protocol - Request</LName>
				<SName>AEP Request</SName>
				<DescID>7136</DescID>
				<CondExp><![CDATA[MLD8[0] == 0x01]]></CondExp>
			</PSpec>
			<PSpec Name="Reply">
				<PSpecID>7138</PSpecID>
				<LName>AppleTalk Echo Protocol - Reply</LName>
				<SName>AEP Reply</SName>
				<DescID>7136</DescID>
				<CondExp><![CDATA[MLD8[0] == 0x02]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="ZIP">
			<PSpecID>7139</PSpecID>
			<Color>color_9</Color>
			<CondExp><![CDATA[MLD8[-1] == 0x06]]></CondExp>
			<PSpec Name="Query">
				<PSpecID>7140</PSpecID>
				<LName>Zone Information Protocol - Query</LName>
				<SName>ZIP Query</SName>
				<Desc>A ZIP Query contains a list of network numbers for which the requesting node would like to receive a corresponding zone list. The request is made to an AppleTalk router. The router does not respond if it does not know any of the requested zone lists. If it does respond, it uses a ZIP Reply or a ZIP Extended Reply. A ZIP Reply is used when all the zones in the list will fit in a single packet. An Extended Reply is used when more than one packet is required to list all the zone lists requested.</Desc>
				<CondExp><![CDATA[MLD8[0] == 0x01]]></CondExp>
			</PSpec>
			<PSpec Name="Reply">
				<PSpecID>7141</PSpecID>
				<LName>Zone Information Protocol - Reply</LName>
				<SName>ZIP Reply</SName>
				<DescID>7140</DescID>
				<CondExp><![CDATA[MLD8[0] == 0x02]]></CondExp>
			</PSpec>
			<PSpec Name="Ext Reply">
				<PSpecID>7142</PSpecID>
				<LName>Zone Information Protocol - Extended Reply</LName>
				<SName>ZIP ExtReply</SName>
				<DescID>7140</DescID>
				<CondExp><![CDATA[MLD8[0] == 0x08]]></CondExp>
			</PSpec>
			<PSpec Name="GetNetInfo Req">
				<PSpecID>7143</PSpecID>
				<LName>Zone Information Protocol - GetNetInfo Request</LName>
				<SName>ZIP GNIR</SName>
				<Desc>When a node starts up, it obtains a provisional network address. It then sends a GetNetInfo Request containing its last known zone name or nil if there was no previously known zone name. AppleTalk routers that receive the request respond if the zone name is valid and a range of net numbers that are valid for that zone. If the requested zone name is not valid, a default zone name is returned with the corresponding net numbers. If there is no response to a GetNetInfo Request, the node assumes there are no zones on the AppleTalk internet. In all cases, the provisional network address is modified accordingly.</Desc>
				<CondExp><![CDATA[MLD8[0] == 0x05]]></CondExp>
			</PSpec>
			<PSpec Name="GetNetInfo Reply">
				<PSpecID>7144</PSpecID>
				<LName>Zone Information Protocol - GetNetInfo Reply</LName>
				<SName>ZIP GNIR</SName>
				<DescID>7143</DescID>
				<CondExp><![CDATA[MLD8[0] == 0x06]]></CondExp>
			</PSpec>
			<PSpec Name="Notify">
				<PSpecID>7145</PSpecID>
				<LName>Zone Information Protocol - Notify</LName>
				<SName>ZIP Notify</SName>
				<Desc>Nodes on an AppleTalk internet need to be told if their zone name has changed. The ZIP Notify packet is used so that nodes will change their zone multicast address and thereby do NBP Lookups correctly thereafter.</Desc>
				<CondExp><![CDATA[MLD8[0] == 0x07]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="ADSP">
			<PSpecID>7146</PSpecID>
			<LName>AppleTalk Data Stream Protocol</LName>
			<SName>AT ADSP</SName>
			<Desc>The AppleTalk Data Stream Protocol is a reliable packet delivery service. Like ATP, it will monitor the connection, retransmit as necessary, and notify the user if the connection fails. Unlike ATP, either side of an ADSP connection may send data at any time to the other end. ADSP is typically used for a spontaneous bidirectional flow connection in applications like virtual terminal connections or some types of file transfer such as back-up and archiving.</Desc>
			<Color>color_10</Color>
			<CondExp><![CDATA[MLD8[-1] == 0x07]]></CondExp>
			<PSpec Name="Control">
				<PSpecID>7147</PSpecID>
				<LName>AppleTalk Data Stream Protocol - Control</LName>
				<SName>ADSP Ctl</SName>
				<Desc>ADSP control packets are used to maintain ADSP&apos;s internal operation and do not contain any client-deliverable data.</Desc>
				<CondExp><![CDATA[(MLD8[12] & 0x80) == 0x80]]></CondExp>
				<PSpec Name="Probe/Ack">
					<PSpecID>7149</PSpecID>
					<LName>AppleTalk Data Stream Protocol - Probe or Acknowledgment</LName>
					<SName>ADSP Probe/Ack</SName>
					<Desc>ADSP Probe or Ack is a control packet which is used inside an ADSP connection to determine if the connection is still valid. A Probe requests an immediate Ack from the other end of the connection to signify both ends are still alive.</Desc>
					<CondExp><![CDATA[(MLD8[12] & 0x0f) == 0x00]]></CondExp>
				</PSpec>
				<PSpec Name="OpenConnReq">
					<PSpecID>7150</PSpecID>
					<LName>AppleTalk Data Stream Protocol - Open Connection Request</LName>
					<SName>ADSP OCR</SName>
					<Desc>Since an ADSP connection has spontaneous bidirectional data flows, each end of the connection must agree to connect to the other end. A successful connection dialog proceeds as an Open Connection Request from one end, followed by an Open Connection Request and Acknowledgment from the other end and then an Open Request Acknowledgment from the original requesting node. Either end of the connection may be unable to fulfill the connection request in which case one of the two Acknowledgment packet may be replaced by a Open Connection Denial packet.</Desc>
					<CondExp><![CDATA[(MLD8[12] & 0x0f) == 0x01]]></CondExp>
				</PSpec>
				<PSpec Name="OpenConnAck">
					<PSpecID>7151</PSpecID>
					<LName>AppleTalk Data Stream Protocol - Open Connection Acknowledge</LName>
					<SName>ADSP OCA</SName>
					<DescID>7150</DescID>
					<CondExp><![CDATA[(MLD8[12] & 0x0f) == 0x02]]></CondExp>
				</PSpec>
				<PSpec Name="OpenConnReqAck">
					<PSpecID>7152</PSpecID>
					<LName>AppleTalk Data Stream Protocol - Open Connection Request Ack</LName>
					<SName>ADSP ORA</SName>
					<DescID>7150</DescID>
					<CondExp><![CDATA[(MLD8[12] & 0x0f) == 0x03]]></CondExp>
				</PSpec>
				<PSpec Name="OpenConnDenial">
					<PSpecID>7153</PSpecID>
					<LName>AppleTalk Data Stream Protocol - Open Connection Denial</LName>
					<SName>ADSP OCD</SName>
					<DescID>7150</DescID>
					<CondExp><![CDATA[(MLD8[12] & 0x0f) == 0x04]]></CondExp>
				</PSpec>
				<PSpec Name="CloseConnAdvice">
					<PSpecID>7154</PSpecID>
					<LName>AppleTalk Data Stream Protocol - Close Connection Advice</LName>
					<SName>ADSP CCA</SName>
					<Desc>There are several ways that an ADSP connection may be closed. The Close Connection Advice packet is a polite way to inform the other end that one end would like to close the connection. Depending on the type of connection, the receiving node may close the connection or disregard the advice if it is still waiting for data or if the application requires an acknowledgment via attention packets that all data has been sent and received. In any case, a connection automatically closes if there is no response to Probe packets.</Desc>
					<CondExp><![CDATA[(MLD8[12] & 0x0f) == 0x05]]></CondExp>
				</PSpec>
				<PSpec Name="ForwardReset">
					<PSpecID>7155</PSpecID>
					<LName>AppleTalk Data Stream Protocol - Forward Reset</LName>
					<SName>ADSP FwdReset</SName>
					<Desc>The Forward Reset Control packet provides a mechanism for a client to abort the delivery of all outstanding data that it has sent to the remote client. Upon receiving this packet, the remote end synchronizes its packet receipt system and then removes all undelivered bytes from its receive queue. The remote end then sends a Forward Reset Acknowledgment to the other end.</Desc>
					<CondExp><![CDATA[((MLD8[12] & 0x0f) == 0x06) || ((MLD8[12] & 0x0f) == 0x07)]]></CondExp>
				</PSpec>
				<PSpec Name="RetranAdvice">
					<PSpecID>7157</PSpecID>
					<LName>AppleTalk Data Stream Protocol - Retransmit Advice</LName>
					<SName>ADSP RTA</SName>
					<Desc>One end of an ADSP connection may send the Retransmit Advice Control packet in response to receiving several consecutive out-of-sequence data packets from the other end. The packet is sent to inform the remote end that it should retransmit the bytes in its send queue beginning with the so-designated byte.</Desc>
					<CondExp><![CDATA[(MLD8[12] & 0x0f) == 0x08]]></CondExp>
				</PSpec>
			</PSpec>
			<PSpec Name="Data">
				<PSpecID>7148</PSpecID>
				<LName>AppleTalk Data Stream Protocol - Data</LName>
				<SName>ADSP Data</SName>
				<Desc>ADSP data packets are used to convey data between the two nodes in the connection as a stream of bytes. The data transmitted may be as little as one byte or as much as will fit in a packet of the underlying transport mechanism.</Desc>
				<CondExp><![CDATA[(MLD8[12] & 0x80) == 0x00]]></CondExp>
			</PSpec>
		</PSpec>
		<PSpec Name="SNMP">
			<PSpecID>7158</PSpecID>
			<LName>Simple Network Management Protocol</LName>
			<SName>AT SNMP</SName>
			<DescID>1519</DescID>
			<Color>color_11</Color>
			<CondExp><![CDATA[MLD8[-1] == 0x08]]></CondExp>
		</PSpec>
		<PSpec Name="ABP">
			<PSpecID>7159</PSpecID>
			<LName>AppleTalk Broadcast Protocol</LName>
			<SName>AT ABP</SName>
			<Desc>ABP is used to broadcast information that is used by other cooperating processes. The first four bytes of the DDP data field contain a unique id which is typically the application creator allowing processes to sort out if the information is relevant to their application. ABP is used in various parts of Apple&apos;s Open Collaboration Environment (AOCE).</Desc>
			<Color>color_12</Color>
			<CondExp><![CDATA[MLD8[-1] == 0x09]]></CondExp>
		</PSpec>
		<PSpec Name="MacIP">
			<PSpecID>7160</PSpecID>
			<LName>IP in AppleTalk DDP</LName>
			<SName>AT MacIP</SName>
			<Desc>MacIP is a method used to encapsulate IP datagrams into AppleTalk DDP packets and can include the complete TCP/UDP/IP protocol stack. There are several restrictions on such IP datagrams including packet length and fragmentation. MacIP is used by applications which are not directly connected into an IP network, but which use AppleTalk connectivity to routers or gateways or remote access servers to gain indirect access to an IP internet.</Desc>
			<Color>color_13</Color>
			<CondExp><![CDATA[MLD8[-1] == 0x16]]></CondExp>
		</PSpec>
	</PSpec>
	<PSpec Name="AARP Children" Type="CommonTable">
		<PSpec Name="Request">
			<PSpecID>451</PSpecID>
			<LName>AARP Request</LName>
			<SName>AARP Request</SName>
			<Desc>AppleTalk nodes and routers keep a table of AppleTalk addresses with a corresponding data link hardware address. An AARP Request contains an AppleTalk internet address and requests someone to respond with the corresponding data link hardware address from their table. Ultimately, a response will be given by the node itself, but often a router or another node may be able to respond more immediately from their own table of addresses. When the requested address is located on a large AppleTalk internet, the Request must be retransmitted by successive routers until the destination network is reached. An AARP Request with no corresponding AARP Response means that the AppleTalk address given is deemed to be unreachable.</Desc>
			<CondExp><![CDATA[MLD16[6] == 0x0001]]></CondExp>
		</PSpec>
		<PSpec Name="Response">
			<PSpecID>452</PSpecID>
			<LName>AARP Response</LName>
			<SName>AARP Response</SName>
			<Desc>An AARP Response is a response to either a AARP Request or an AARP Probe. AppleTalk nodes and routers keep a table of AppleTalk addresses with a corresponding data link hardware address. An AARP Response contains an AppleTalk internet address and the corresponding data link hardware address from that node&apos;s table. Ultimately, a response will be given by the node whose address is given in the Request or Probe, but often a router or another node may be able to respond from their own table of addresses. An AARP Request with no corresponding AARP Response means that the AppleTalk address given is deemed to be unreachable.</Desc>
			<CondExp><![CDATA[MLD16[6] == 0x0002]]></CondExp>
		</PSpec>
		<PSpec Name="Probe">
			<PSpecID>453</PSpecID>
			<LName>AARP Probe</LName>
			<SName>AARP Probe</SName>
			<Desc>The AARP Probe is broadcast with a node&apos;s tentative choice for its address. If there is no AARP Response to the Probe after a certain amount of time, the Probe is sent out again and this sequence is repeated for a maximum number of retries. If no responses are ever received, the address is assumed to be available and will subsequently be adopted by that node. If the tentative address is already in use, the node which is using the tentative address must send an AARP Response packet. The original node, having received the Response, chooses a different tentative address. AARP Probes usually appear when a networked computer is first tries to join the AppleTalk internet.</Desc>
			<CondExp><![CDATA[MLD16[6] == 0x0003]]></CondExp>
		</PSpec>
	</PSpec>
	<PSpec Name="Ethernet Type 2 Children" Type="CommonTable">
		<Link Name="Ethernet"/>
		<PSpec Name="Loopback">
			<PSpecID>11</PSpecID>
			<LName>Loopback Diagnostic Protocol</LName>
			<SName>Loopback</SName>
			<Desc>The Loopback Diagnostic Protocol is used by routers and bridges to test the integrity of the physical link and report encountered errors.</Desc>
			<Color>color_7</Color>
			<CondExp><![CDATA[EthernetType == 0x9000]]></CondExp>
		</PSpec>
		<PSpec Name="AppleTalk">
			<PSpecID>99</PSpecID>
			<LName>AppleTalk Phase 1</LName>
			<SName>AppleTalk Ph1</SName>
			<Desc>AppleTalk Phase 1 is the original implementation of the AppleTalk protocol on Ethernet that was used for communication between Apple products. This protocol was later upgraded and replaced by AppleTalk Phase 2 which complies with IEEE standard 802.3 and which solved some of the problems inherent in Phase 1. Many AppleTalk routers continue to support Phase 1 as an option for historical purposes.</Desc>
			<Color>color_2</Color>
			<CondExp><![CDATA[EthernetType == 0x809b]]></CondExp>
			<NextLayer>
				<Exp><![CDATA[     3     ]]></Exp>
			</NextLayer>
			<PSpec Name="Short DDP">
				<PSpecID>7300</PSpecID>
				<LName>Short Datagram Delivery Protocol</LName>
				<SName>Short DDP</SName>
				<Desc>DDP is AppleTalk&apos;s basic transport-level protocol for delivering packets (datagrams) between devices. It provides a mechanism for higher-level AppleTalk protocols to address any node on the AppleTalk internet uniquely. Short DDP and Long DDP packets are identical except that Short DDP packets assume that the packets are between devices on the same AppleTalk segment (same net number) while Long DDP packets contain complete address information for different AppleTalk networks allowing packets to be routed anywhere on the AppleTalk internet by AppleTalk routers.</Desc>
				<Color>color_15</Color>
				<CondExp><![CDATA[PLD8[2] == 0x01]]></CondExp>
				<NextLayer>
					<Exp><![CDATA[     5     ]]></Exp>
				</NextLayer>
				<Link Name="AppleTalk DDP"/>
			</PSpec>
			<PSpec Name="Long DDP">
				<PSpecID>7500</PSpecID>
				<LName>Long Datagram Delivery Protocol</LName>
				<SName>Long DDP</SName>
				<DescID>7300</DescID>
				<Color>color_7</Color>
				<CondExp><![CDATA[PLD8[2] == 0x02]]></CondExp>
				<NextLayer>
					<Exp><![CDATA[     13     ]]></Exp>
				</NextLayer>
				<Link Name="AppleTalk DDP"/>
			</PSpec>
		</PSpec>
		<PSpec Name="VINES-Internet">
			<PSpecID>4500</PSpecID>
			<LName>Banyan VINES Internet Protocol</LName>
			<SName>VINES IP</SName>
			<Desc>VINES is a complete networking implementation sold by Banyan Systems Incorporated. It runs an many different computer platforms. It has multiple layers comprised of packet routing, network, session and application control.</Desc>
			<Color>color_14</Color>
			<CondExp><![CDATA[(EthernetType == 0x0bad) || (EthernetType == 0x80c4)]]></CondExp>
			<Link Name="VINES Children"/>
		</PSpec>
		<PSpec Name="PPPoE">
			<PSpecID>20</PSpecID>
			<LName>PPP over Ethernet</LName>
			<SName>PPPoE</SName>
			<Desc>The Point-to-Point Protocol (PPP) provides a standard method for transporting multi-protocol datagrams over point-to-point links. PPPoE provides a method for building PPP sessions and encapsulating PPP packets over Ethernet.</Desc>
			<Color>color_3</Color>
			<CondExp><![CDATA[(EthernetType == 0x8863) || (EthernetType == 0x8864)]]></CondExp>
			<PSpec Name="Discovery">
				<PSpecID>21</PSpecID>
				<LName>PPP over Ethernet Discovery</LName>
				<SName>PPPoE Discovery</SName>
				<Desc>The Point-to-Point Protocol (PPP) provides a standard method for transporting multi-protocol datagrams over point-to-point links. PPPoE provides a method for building PPP sessions and encapsulating PPP packets over Ethernet.</Desc>
				<Color>color_4</Color>
				<CondExp><![CDATA[EthernetType == 0x8863]]></CondExp>
			</PSpec>
			<PSpec Name="Session">
				<PSpecID>22</PSpecID>
				<LName>PPP over Ethernet Session</LName>
				<SName>PPPoE Session</SName>
				<Desc>The Point-to-Point Protocol (PPP) provides a standard method for transporting multi-protocol datagrams over point-to-point links. PPPoE provides a method for building PPP sessions and encapsulating PPP packets over Ethernet.</Desc>
				<Color>color_4</Color>
				<CondExp><![CDATA[EthernetType == 0x8864]]></CondExp>
				<NextLayer>
					<Exp><![CDATA[ 8 ]]></Exp>
				</NextLayer>
				<Definitions>
					<Define>
						<Name>ProtocolField</Name>
						<Value><![CDATA[PLD16[6]]]></Value>
					</Define>
				</Definitions>
				<PSpec Name="Padding">
					<PSpecID>23</PSpecID>
					<LName>PPPoE Padding</LName>
					<SName>Padding</SName>
					<CondExp><![CDATA[ProtocolField == 0x0001]]></CondExp>
				</PSpec>
				<PSpec Name="First Choice Compression">
					<PSpecID>24</PSpecID>
					<LName>PPPoE First Choice Compression</LName>
					<SName>First Choice Compression</SName>
					<CondExp><![CDATA[ProtocolField == 0x00fd]]></CondExp>
				</PSpec>
				<PSpec Name="IP">
					<PSpecID>1000</PSpecID>
					<CondExp><![CDATA[ProtocolField == 0x0021]]></CondExp>
					<NextLayer>
						<Exp><![CDATA[     ((MLD8[0] & 0x0f) * 4)     ]]></Exp>
					</NextLayer>
					<Definitions>
						<Define>
							<Name>ProtocolID</Name>
							<Value><![CDATA[PLD8[9]]]></Value>
						</Define>
						<Define>
							<Name>IPHdrLength</Name>
							<Value><![CDATA[((PLD8[0] & 0x0f) * 4)]]></Value>
						</Define>
						<Define>
							<Name>IPTotalLength</Name>
							<Value><![CDATA[PLD16[2]]]></Value>
						</Define>
					</Definitions>
					<Link Name="IP Children"/>
					<PSpec Name="IP Fragment" Sort="First">
						<PSpecID>1001</PSpecID>
						<LName>Fragmented IP</LName>
						<SName>IP Fragment</SName>
						<CondExp><![CDATA[    (PLD16[6] & 0x1fff) != 0 ]]></CondExp>
					</PSpec>
				</PSpec>
				<PSpec Name="IP Control Protocol">
					<PSpecID>25</PSpecID>
					<LName>PPPoE IP Control Protocol</LName>
					<SName>IP Control Protocol</SName>
					<CondExp><![CDATA[ProtocolField == 0x8021]]></CondExp>
				</PSpec>
				<PSpec Name="Link Control">
					<PSpecID>26</PSpecID>
					<LName>PPPoE Link Control</LName>
					<SName>Link Control</SName>
					<CondExp><![CDATA[ProtocolField == 0xc021]]></CondExp>
				</PSpec>
				<PSpec Name="Password Authentication">
					<PSpecID>27</PSpecID>
					<LName>PPPoE Password Authentication</LName>
					<SName>Password Authentication</SName>
					<CondExp><![CDATA[ProtocolField == 0xc023]]></CondExp>
				</PSpec>
				<PSpec Name="Link Quality Report">
					<PSpecID>28</PSpecID>
					<LName>PPPoE Link Quality Report</LName>
					<SName>Link Quality Report</SName>
					<CondExp><![CDATA[ProtocolField == 0xc025]]></CondExp>
				</PSpec>
				<PSpec Name="Challenge-Handshake Authentication">
					<PSpecID>29</PSpecID>
					<LName>PPPoE Challenge-Handshake Authentication</LName>
					<SName>Challenge-Handshake Authentication</SName>
					<CondExp><![CDATA[ProtocolField == 0xc223]]></CondExp>
				</PSpec>
			</PSpec>
		</PSpec>
	</PSpec>
</ProtoSpecTable>
