rip2_schema = library_schema:new( 1, ["time", "ip", "ip", "ip", "ip", "integer"], scope()); func rip2 { $hold = ip.len - 20; $num_routes = $hold / 20; $x = 0; $offset = 4; # scoot us past command, vers, and routing domain while ($x < $num_routes){ # again, this should be done as host(long(udp.blob, 8)) but there is # a bug in the long() code prevents us from currently doing this $IPaddr = host( byte(udp.blob, (($x * 20) + $offset + 4)), byte(udp.blob, (($x * 20) + $offset + 5)), byte(udp.blob, (($x * 20) + $offset + 6)), byte(udp.blob, (($x * 20) + $offset + 7))); $IPsubnet = host( byte(udp.blob, (($x * 20) + $offset + 8)), byte(udp.blob, (($x * 20) + $offset + 9)), byte(udp.blob, (($x * 20) + $offset + 10)), byte(udp.blob, (($x * 20) + $offset + 11))); $IPnexthop = host( byte(udp.blob, (($x * 20) + $offset + 12)), byte(udp.blob, (($x * 20) + $offset + 13)), byte(udp.blob, (($x * 20) + $offset + 14)), byte(udp.blob, (($x * 20) + $offset + 15))); $metric = long( udp.blob, ( ($x * 20) + $offset + 16)); $x = $x + 1; record system.time, ip.src, $IPaddr, $IPsubnet, $IPnexthop, $metric to rip2_recorder; } } filter ripfilt2 udp ( dport : 520 ) { $hold = udp.len - 12; if ($hold <= 0){ echo("no data in udp packet\n"); return; } # setup command and version infor $rip_cmd = byte(udp.blob, 0); $rip_vers = byte(udp.blob, 1); if ($rip_vers == 2){ rip2(); } else { return; } } rip2_recorder=recorder( "bin/histogram packages/test/rip2.cfg", "rip2_schema" );