The udp module

The udp module reads raw packets from a UDP connection over the Internet.

The udp module is  an input module, meaning that its purpose is to read data from some sources, and convert it to Orchids events.  The sources  should be declared in the orchids-inputs.conf file.  Admissible sources are UDP (SOCK_DGRAM) connections over the Internet (AF_INET).  For local UDP connections, use sockunix instead.

The udp module reads from these sources and produces Orchids events, one per UDP packet.  The contents of each packet will then be found in the .udp.msg field of the event.

Configuration options


(The udp module in fact understands the special INPUT directive.  It takes a port number as argument, and connects to that port.  This should not be used inside the udp module configuration file.  Instead, input should be specified in the orchids-inputs.conf file.)


The last field is .udp.msg, available for further dissection; the dissection key is .udp.tag, which is a string rendition of the .udp.dst_port field.  This requires a bit of explanation.  If you write:

DISSECT udp textfile 514

in the orchids-inputs.conf file, then you will get UDP packets from port 514 (the syslog port). This will be made clear by the fact that their .udp.dst_port field will be equal to the unsigned integer 514.  Their .udp.tag field will be the string "514", which can then be used as a dissection tag.

Field Type Mono? Description
.udp.event uint event number
.udp.time timeval reception time (by Orchids)
.udp.src_addr ipv4 source address
.udp.src_port uint source port
.udp.dst_port uint destination port
.udp.tag str dissection tag
.udp.msg bstr message, as raw packet