2.2.2 WSHA SoH

The following subsections define the TLV constituents of the WSHA SoH packet. All of the values MUST be present, unless otherwise noted. The values MUST be in the order in which they are presented in this specification. TLVs 5, 6, 8, 9, 11, and 12 MUST have at least one instance. They MAY have multiple instances, depending on how many firewall, antivirus, and antispyware products are installed. The M and R bits are defined in the Protocol Bindings for SoH [TNC-IF-TNCCSPBSoH] and are ignored by the WSHV upon receipt. All TLV values are sent in network byte order, which is big-endian, except for the Flag field of TLV 2, the Version field of TLV 3, the Security_Updates_DurationSinceLastSynch field of TLV 17, and the Security_Updates_UpdatesFlag field of TLV 19, which are sent in machine byte order and are little-endian.