UDP Chain¶
This module contains the UDPChain flow analysis chain which can be used by PATHspider’s Observer for recording UDP details.
- class pathspider.chains.udp.UDPChain[source]¶
Field Name
Type
Meaning
udp_zero_checksum_fwd
bool
True if the last packet in the flow in the forward direction had the UDP checksum disabled (set to zero).
udp_zero_checksum_rev
bool
True if the last packet in the flow in the reverse direction had the UDP checksum disabled (set to zero).
- new_flow(rec, ip)[source]¶
For a new flow, all fields will be initialised to
None
.- Parameters
rec (dict) – the flow record
ip (plt.ip or plt.ip6) – the IP or IPv6 packet that triggered the creation of a new flow record
- Returns
Always
True
- Return type
bool
- udp(rec, udp, rev)[source]¶
Records details from UDP datagram about the UDP header.
- Parameters
rec (dict) – the flow record
tcp – the UDP packet that was observed to be part of this flow
rev (bool) –
True
if the packet was in the reverse direction,False
if in the forward direction
- Returns
Always
True
- Return type
bool