UDP (udp)
- Layer: L4 (transport)
- Header: 8 octets (fixed)
- Notes: MACsec / GTPv2-C / Diameter / SIP / RTP (P2), User-defined protocols (protocols.d)
Reached from
| Lower layer | Selector | Value |
|---|---|---|
ipv4 | protocol | 17 (0x11) |
ipv6 | next_header | 17 (0x11) |
ipv6_hopopts | next_header | 17 (0x11) |
ipv6_route | next_header | 17 (0x11) |
ipv6_srh | next_header | 17 (0x11) |
ipv6_frag | next_header | 17 (0x11) |
ipv6_dstopts | next_header | 17 (0x11) |
Fields
| Field | Type | Default | Auto | Description |
|---|---|---|---|---|
src_port | uint(16) | 49152 | Source port. | |
dst_port | uint(16) | 9 | Destination port; selects the next layer when it is Auto (53 = DNS, 67 / 68 = DHCP, 4789 = VXLAN…). | |
length | uint(16) | Length of the header and payload in octets | Length of header and payload in octets (Auto). | |
checksum | uint(16) | Internet checksum with pseudo header over the header and everything after it; a computed 0 is sent as all ones | Internet checksum with the IPv4 / IPv6 pseudo header (Auto; 0 becomes 0xffff). |
Next layer
The next layer is selected by dst_port; when the field is Auto the builder writes the value of the protocol stacked above. When decoding, src_port is looked up too if the first field matches no entry.
| Value | Protocol | Note |
|---|---|---|
| 520 (0x0208) | rip | |
| 521 (0x0209) | ripng | |
| 1701 (0x06a5) | l2tpv2 | |
| 1985 (0x07c1) | hsrp | |
| 1985 (0x07c1) | hsrpv2 | |
| 2029 (0x07ed) | hsrpv2 | |
| 2152 (0x0868) | gtpu | |
| 3222 (0x0c96) | glbp | |
| 4789 (0x12b5) | vxlan | |
| 6081 (0x17c1) | geneve | |
| 6635 (0x19eb) | mpls | |
| 9899 (0x26ab) | sctp | |
| 646 (0x0286) | ldp | |
| 3784 (0x0ec8) | bfd | |
| 4784 (0x12b0) | bfd | |
| 6784 (0x1a80) | bfd | |
| 2123 (0x084b) | gtpv2 | |
| 5060 (0x13c4) | sip | |
| 5004 (0x138c) | rtp | |
| 5005 (0x138d) | rtcp | |
| 53 (0x0035) | dns | |
| 67 (0x0043) | dhcpv4 | |
| 68 (0x0044) | dhcpv4 | |
| 69 (0x0045) | tftp | |
| 123 (0x007b) | ntp | |
| 161 (0x00a1) | snmp | |
| 162 (0x00a2) | snmp | |
| 514 (0x0202) | syslog | |
| 546 (0x0222) | dhcpv6 | |
| 547 (0x0223) | dhcpv6 | |
| 1812 (0x0714) | radius | |
| 1813 (0x0715) | radius | |
| 319 (0x013f) | ptp | |
| 319 (0x013f) | ptp_sync | |
| 319 (0x013f) | ptp_delay_req | |
| 319 (0x013f) | ptp_pdelay_req | |
| 319 (0x013f) | ptp_pdelay_resp | |
| 320 (0x0140) | ptp | |
| 320 (0x0140) | ptp_follow_up | |
| 320 (0x0140) | ptp_delay_resp | |
| 320 (0x0140) | ptp_pdelay_resp_follow_up | |
| 320 (0x0140) | ptp_announce | |
| 320 (0x0140) | ptp_signaling | |
| 320 (0x0140) | ptp_management |
Constraints
| Level | Rule |
|---|---|
| warning | header and payload at least 8 octets |
Sample templates
- interop-bfd-session-up —
templates/interop/bfd-session-up.wpg.yaml - interop-ldp-link-hello —
templates/interop/ldp-link-hello.wpg.yaml - interop-ripv2-response-route —
templates/interop/ripv2-response-route.wpg.yaml - bad-fcs —
templates/malformed/bad-fcs.wpg.yaml - bad-ipv4-checksum —
templates/malformed/ipv4-bad-checksum.wpg.yaml - bad-ipv4-ihl —
templates/malformed/ipv4-bad-ihl.wpg.yaml - bad-ipv4-total-length —
templates/malformed/ipv4-total-length-too-long.wpg.yaml - bad-ipv4-total-length-short —
templates/malformed/ipv4-total-length-too-short.wpg.yaml - truncated-ipv4-udp —
templates/malformed/ipv4-truncated.wpg.yaml - bad-ipv6-payload-length —
templates/malformed/ipv6-bad-payload-length.wpg.yaml - bad-udp-checksum —
templates/malformed/udp-bad-checksum.wpg.yaml - bad-udp-length —
templates/malformed/udp-bad-length.wpg.yaml - mpls-in-udp —
templates/protocols/encap/mpls-in-udp.wpg.yaml - frame-with-fcs —
templates/protocols/frame/fcs-auto.wpg.yaml - jumbo-frame-9000 —
templates/protocols/frame/jumbo-9000.wpg.yaml - dot1ad-qinq-frame —
templates/protocols/l2/dot1ad.wpg.yaml - dot1q-frame —
templates/protocols/l2/dot1q.wpg.yaml - dot3-llc-snap-frame —
templates/protocols/l2/dot3-llc-snap.wpg.yaml - ipv4-dscp-ecn-matrix —
templates/protocols/l3/ipv4-dscp-ecn-matrix.wpg.yaml - ipv4-router-alert —
templates/protocols/l3/ipv4-router-alert.wpg.yaml - ipv4-udp —
templates/protocols/l3/ipv4.wpg.yaml - ipv6-dstopts —
templates/protocols/l3/ipv6-dstopts.wpg.yaml - ipv6-ext-chain —
templates/protocols/l3/ipv6-ext-chain.wpg.yaml - ipv6-fragment —
templates/protocols/l3/ipv6-frag.wpg.yaml - ipv6-hopopts-router-alert —
templates/protocols/l3/ipv6-hopopts.wpg.yaml - ipv6-routing-type2 —
templates/protocols/l3/ipv6-routing.wpg.yaml - ipv6-udp —
templates/protocols/l3/ipv6.wpg.yaml - sctp-over-udp —
templates/protocols/l4/sctp-over-udp.wpg.yaml - udp-over-ipv6 —
templates/protocols/l4/udp-ipv6.wpg.yaml - udp-datagram —
templates/protocols/l4/udp.wpg.yaml - gtpv2-create-session-request —
templates/protocols/mobile/gtpv2-create-session-request.wpg.yaml - gtpv2-create-session-response —
templates/protocols/mobile/gtpv2-create-session-response.wpg.yaml - gtpv2-echo-request —
templates/protocols/mobile/gtpv2-echo-request.wpg.yaml - ldp-hello —
templates/protocols/mpls/ldp-hello.wpg.yaml - ldp-targeted-hello —
templates/protocols/mpls/ldp-targeted-hello.wpg.yaml - sr-mpls-entropy —
templates/protocols/mpls/sr-mpls-entropy.wpg.yaml - bfd-auth —
templates/protocols/oam/bfd-auth.wpg.yaml - bfd-multihop-ipv6 —
templates/protocols/oam/bfd-multihop-ipv6.wpg.yaml - bfd-single-hop —
templates/protocols/oam/bfd-single-hop.wpg.yaml - micro-bfd —
templates/protocols/oam/micro-bfd.wpg.yaml - ripng-response —
templates/protocols/routing/ripng-response.wpg.yaml - ripv2-response —
templates/protocols/routing/ripv2-response.wpg.yaml - srv6-h-encaps-ipv4 —
templates/protocols/srv6/srv6-h-encaps-ipv4.wpg.yaml - srv6-srh-udp —
templates/protocols/srv6/srv6-srh-udp.wpg.yaml - ptp-announce-udp —
templates/protocols/timing/ptp-announce-udp.wpg.yaml - ptp-delay-req-udp —
templates/protocols/timing/ptp-delay-req-udp.wpg.yaml - ptp-delay-resp-udp —
templates/protocols/timing/ptp-delay-resp-udp.wpg.yaml - ptp-signaling-unicast —
templates/protocols/timing/ptp-signaling-unicast.wpg.yaml - rtcp-feedback-app —
templates/protocols/voip/rtcp-feedback-app.wpg.yaml - rtcp-rr-bye —
templates/protocols/voip/rtcp-rr-bye.wpg.yaml - rtcp-sr-sdes —
templates/protocols/voip/rtcp-sr-sdes.wpg.yaml - rtp-pcmu —
templates/protocols/voip/rtp-pcmu.wpg.yaml - sip-invite —
templates/protocols/voip/sip-invite.wpg.yaml - scenario-dhcp-discover-flood —
templates/scenarios/dhcp-discover-flood.wpg.yaml - scenario-frame-size-sweep —
templates/scenarios/frame-size-sweep.wpg.yaml - scenario-jumbo-udp-mtu-probe —
templates/scenarios/jumbo-udp-mtu-probe.wpg.yaml - scenario-mac-flood —
templates/scenarios/mac-flood.wpg.yaml - scenario-qinq-service-sweep —
templates/scenarios/qinq-service-sweep.wpg.yaml - sr-mpls-prefix-sid-sweep —
templates/scenarios/sr-mpls-prefix-sid-sweep.wpg.yaml - scenario-udp-qos-matrix —
templates/scenarios/udp-qos-matrix.wpg.yaml - scenario-vlan-id-sweep —
templates/scenarios/vlan-id-sweep.wpg.yaml