 If the file does receive data from the server in excess of 20 bytes it will be in the following format:  <2 byte data length><0xABCDEF88><zlib-encrypted data>  The decrypted data will contain the following fields:  The attack type field is used to determine if a SYN DDoS or DNS DDoS is used in an attack.