--- /dev/null
+**Phase 1: Completed pre-decoding.
+ full event: 'Apr 17 22:20:29 hostj named[312]: [ID 295310 daemon.notice] security: notice: dropping source port zero packet from [64.211.251.254].0'
+ hostname: 'hostj'
+ program_name: 'named'
+ log: 'security: notice: dropping source port zero packet from [64.211.251.254].0'
+
+**Phase 2: Completed decoding.
+ decoder: 'named'
+ srcip: '64.211.251.254'
+
+**Phase 3: Completed filtering (rules).
+ Rule id: '12101'
+ Level: '12'
+ Description: 'Invalid DNS packet. Possibility of attack.'
+**Alert to be generated.
+
+