Forum Discussion
semperfiguy_759
Nimbostratus
NimbostratusParse UDP::payload
How do I parse out a string from UDP::payload? I am trying to parse out the file name from a TFTP get.
UDP::payload looks like this ??filename??netascii??
string range works fine, but the file name in 'n' length, so I would like to use string map. Not having luck.
when CLIENT_ACCEPTED {
set fileName [string map {"??" "" "??netascii??" ""} [UDP::payload]]
log local0.debug "Client IP: [IP::client_addr] "
log local0.debug "TFTP File Name : $fileName "
}
1 Reply
- Kai_Wilke
MVP
Hi Semperfiguy,
you may try this syntax...
when CLIENT_ACCEPTED { log local0.debug "Payload: [UDP::payload]" binary scan [UDP::payload] xxa* payload log local0.debug "Payload_a: $payload" log local0.debug "TFTP File Name : [lindex [split $payload \000] 0]" }Cheers, Kai
