Forum Discussion

semperfiguy_759's avatar
semperfiguy_759
Icon for Nimbostratus rankNimbostratus
Feb 19, 2016

Parse UDP::payload

How do I parse out a string from UDP::payload? I am trying to parse out the file name from a TFTP get.

UDP::payload looks like this ??filename??netascii??

string range works fine, but the file name in 'n' length, so I would like to use string map. Not having luck.

when CLIENT_ACCEPTED {

set fileName [string map {"??" "" "??netascii??" ""} [UDP::payload]]

 log local0.debug "Client IP: [IP::client_addr] "
 log local0.debug "TFTP File Name : $fileName "

}

1 Reply

  • Hi Semperfiguy,

    you may try this syntax...

    when CLIENT_ACCEPTED {
        log local0.debug "Payload: [UDP::payload]"
        binary scan [UDP::payload] xxa* payload
        log local0.debug "Payload_a: $payload"
        log local0.debug "TFTP File Name : [lindex [split $payload \000] 0]"
    }
    

    Cheers, Kai