Service Type Other numeric value

[SajjadShahid]

Hi,

I want to exclude OTHER in the service type result set, wondering what is the numeric code for it so that I can exclude it with service != ?? in the rule where clause.

Thanks in advance,

[EricPartington]

service!=0

[SajjadShahid]

Thanks a lot, Eric.

Much appreciated!

[ThomasFedorchuk]

You can find the service "values" in the file /etc/netwitness/ng/index-decoder.xml.

Here is a sample snippet output of the file...

<key description="Service Type" level="IndexNone" name="service" valueMax="75" format="UInt32" defaultAction="Open">
<aliases>
<alias format="$alias" value="0">OTHER</alias>
<alias format="$alias" value="20">FTPD</alias>
<alias format="$alias" value="21">FTP</alias>
<alias format="$alias" value="22">SSH</alias>
<alias format="$alias" value="23">TELNET</alias>
<alias format="$alias" value="25">SMTP</alias>

[SajjadShahid]

Thanks a lot for the info, Thomas.

Much appreciated!