options ls=80 nocenter;
libname library '.';
libname mystuff base '.';

data mystuff.all2;
   length type2 $ 16;
   set mystuff.all;

   type2='not classified';
   if prot=17 then type2='udp';
   else if prot=50 then type2='esp';
   else if prot=1 then type2='icmp';
   else if prot=47 then type2='gre';
   else if prot=6 then do;
      if (srcport=80) or (dstport=80) or
         (srcport=8000) or (dstport=8000) or
         (srcport=8080) or (dstport=8080) then type2='http';
      else if (srcport=443) or (dstport=443) then type2='https';
      else if (srcport=22) or (dstport=22) then type2='ssh';
      else if (srcport=25) or (dstport=25) then type2='smtp';
      else if (srcport=388) or (dstport=388) then type2='unidata';
      else if (srcport=20) or (dstport=20) then type2='ftp';
      else if (srcport=1935) or (dstport=1935) then type2='flash macromedia';
      else if (srcport=873) or (dstport=873) then type2='rsync';
      else if (srcport=554) or (dstport=554) then type2='rtsp';
      else if (srcport=119) or (dstport=119) then type2='nntp';
      else if (srcport=3128) or (dstport=3128) then type2='squid';
      else if (srcport=993) or (dstport=993) then type2='imaps';
      else if (srcport=3074) or (dstport=3074) then type2='xbox';
      else if (40000<=srcport<=40030) or
              (40000<=dstport<=40030) then type2='port 40000-40030';
      else if (20000<=srcport<=20030) or
              (20000<=dstport<=20030) then type2='port 20000-20030';
      else if (dstport=5101) and (doctets>=1000000) then type2='nuttcp';
      end;

   else if (firstoctdst=232) then type2='ssm';

   else if ((224<=firstoctdst<=239) or
           ((src_as=0) and (dst_as=0))) then
           type2='mcast';

proc freq data=mystuff.all2 order=freq;
  table type2;
  weight doctets;
  run;

proc freq data=mystuff.all2 order=freq;
  table prot srcport dstport srcaddr dstaddr;
  weight doctets;
  where type2="not classified";
  run;