{"id":171,"date":"2015-01-23T16:40:11","date_gmt":"2015-01-23T16:40:11","guid":{"rendered":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/?page_id=171"},"modified":"2017-12-25T12:02:26","modified_gmt":"2017-12-25T12:02:26","slug":"the-udp-module","status":"publish","type":"page","link":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/?page_id=171","title":{"rendered":"The udp module"},"content":{"rendered":"

The udp<\/code> module reads raw packets from a UDP<\/a> connection over the Internet.<\/p>\n

The udp<\/code> module is\u00a0 an input module<\/a>, meaning that its purpose is to read data from some sources, and convert it to Orchids events.\u00a0 The sources\u00a0 should be declared in the orchids-inputs.conf<\/code><\/a> file.\u00a0 Admissible sources are UDP\u00a0(SOCK_DGRAM<\/code>) connections over the Internet (AF_INET<\/code>).\u00a0 For local UDP connections, use sockunix<\/code><\/a> instead.<\/p>\n

The udp<\/code> module reads from these sources and produces Orchids events, one per UDP packet.\u00a0 The contents of each packet will then be found in the .udp.msg<\/code> field of the event.<\/p>\n

Configuration options<\/h3>\n

None.<\/p>\n

(The udp<\/code> module in fact understands the special INPUT<\/code> directive.\u00a0 It takes a port number as argument, and connects to that port.\u00a0 This should not<\/em> be used inside the udp<\/code> module configuration file.\u00a0 Instead, input should be specified in the orchids-inputs.conf<\/code><\/a> file.)<\/p>\n

Fields<\/h3>\n

The last field is .udp.msg<\/code>, available for further dissection; the dissection key is .udp.tag<\/code>, which is a string rendition of the\u00a0.udp.dst_port<\/code> field.\u00a0 This requires a bit of explanation.\u00a0 If you write:<\/p>\n

DISSECT udp textfile 514<\/pre>\n
in the orchids-inputs.conf<\/code> file, then you will get UDP packets from port 514 (the syslog<\/code> port). This will be made clear by the fact that their .udp.dst_port<\/code> field will be equal to the unsigned integer 514.\u00a0 Their .udp.tag<\/code> field will be the string \"514\"<\/code>, which can then be used as a dissection tag<\/a>.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Field<\/th>\nType<\/a><\/th>\nMono<\/a>?<\/th>\nDescription<\/th>\n<\/tr>\n<\/tbody>\n
.udp.event<\/code><\/td>\nuint<\/code><\/td>\n\u2713<\/td>\nevent number<\/td>\n<\/tr>\n
.udp.time<\/code><\/td>\ntimeval<\/code><\/td>\n\u2713<\/td>\nreception time (by Orchids)<\/td>\n<\/tr>\n
.udp.src_addr<\/code><\/td>\nipv4<\/code><\/td>\n<\/td>\nsource address<\/td>\n<\/tr>\n
.udp.src_port<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\nsource port<\/td>\n<\/tr>\n
.udp.dst_port<\/code><\/td>\nuint<\/code><\/td>\n<\/td>\ndestination port<\/td>\n<\/tr>\n
.udp.tag<\/code><\/td>\nstr<\/code><\/td>\n<\/td>\ndissection tag<\/td>\n<\/tr>\n
.udp.msg<\/code><\/td>\nbstr<\/code><\/td>\n<\/td>\nmessage, as raw packet<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
The udp module reads raw packets from a UDP connection over the Internet. The udp module is\u00a0 an input module, meaning that its purpose is to read data from some sources, and convert it to Orchids events.\u00a0 The sources\u00a0 should be declared in the orchids-inputs.conf file.\u00a0 Admissible sources are UDP\u00a0(SOCK_DGRAM) connections over the Internet (AF_INET).\u00a0 … Continue reading The udp module<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","meta":{"footnotes":""},"class_list":["post-171","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=\/wp\/v2\/pages\/171","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=171"}],"version-history":[{"count":13,"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=\/wp\/v2\/pages\/171\/revisions"}],"predecessor-version":[{"id":738,"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=\/wp\/v2\/pages\/171\/revisions\/738"}],"wp:attachment":[{"href":"https:\/\/projects.lsv.ens-paris-saclay.fr\/orchidsdoc\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=171"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}