Name

nexp-udp — User Datagram Protocol (UDP) support for Network Expect

Synopsis

PDU definition:

udp ( [src=num,] [dst=num,] [cksum=num,] [length=num] )

PDU decoding:

$udp(srcport), $udp(dstport), $udp(length), $udperror(srcport), $udperror(dstport), $udperror(length)

PDU Definition

src = NUMSPEC

Specifies the source UDP port. Default: 1073.

dst = NUMSPEC

Specifies the destination UDP port.

cksum = NUMSPEC

Forces a specific UDP checksum. Default: valid, auto-calculated checksum of the UDP datagram.

length = NUMSPEC

Forces a specific UDP length. Default: valid, auto-calculated length of the UDP datagram.

PDU Decoding

The following Tcl variables are available to Tcl scripts after any Network Expect command that reads and decodes packets has decoded a packet. Commands that read and decode packets include the expect_network family of commands as well as the pdu decode command.

$udp(srcport)

The UDP source port the received UDP datagram.

$udp(dstport)

The UDP destination port of the received UDP datagram.

$udp(length)

The 16-bit length field of the received UDP datagram.

send_expect Support

Network Expect UDP PDUs support the send_expect command.

The hash of an UDP PDU is the bitwise XOR of the source and destination UDP ports, which is a 16-bit value.

A received UDP PDU is considered to be a response to an injected stimulus if the hash of the received UDP datagram is the same as that of the injected stimulus and the following conditions are met:

  • The source port of the injected UDP datagram is the same as the destination port of the received UDP datagram.

  • The destination port of the injected UDP datagram is the same as the source port of the received UDP datagram.

Examples

  1. A simple UDP datagram:

    ip(dst = www.example.com)/udp(src = random, dst = 53)/raw('ABCDEFG')
    	
  2. A definition for an UDP datagram that forces a bogus length field in the UDP header:

    ip(dst = www.example.com)/udp(src = random, dst = 53, \
       length = 5)/raw('ABCDEFG')
    	

VERSION

This man page is correct for version 1.0 of Network Expect.

SEE ALSO

nexp(1), nexp-numspec(1)

AUTHOR

UDP support for Network Expect was written by Eloy Paris <peloy@netexpect.org>. The "Send and Expect" functionality of the UDP module was borrowed from Scapy, the packet manipulation program written in Python by Philippe Biondi.

This man page was written by Eloy Paris.