From the table, the direction column has one byte flag represented by an integer where 1 represents “incoming broadcast packets”, 2 represents “outgoing broadcast”, 3 represents “outgoing broadcast” and 4 represents “incoming unicast”. The protocol column represents transport-layer protocols using an integer such as 6 represents “TCP” and 17 represents “UDP”. The Key code column is one byte virtual key code that identifies the data types such as “d9” represents worm behavior and others represent normal behavior.