#include <netinet/udp.h>  /* struct udphdr */

/* Parse UDP header from raw packet bytes */
void parse_udp(const uint8_t *ip_payload, uint16_t ip_payload_len) {
    const struct udphdr *udp = (const struct udphdr *)ip_payload;

    uint16_t src_port = ntohs(udp->uh_sport);   /* or source */
    uint16_t dst_port = ntohs(udp->uh_dport);   /* or dest */
    uint16_t length   = ntohs(udp->uh_ulen);    /* total datagram length */
    uint16_t checksum = ntohs(udp->uh_sum);     /* 0 = disabled */

    uint16_t data_len = length - 8;             /* subtract header */
    const uint8_t *payload = ip_payload + 8;    /* payload after 8-byte header */

    printf("UDP: %u → %u  len=%u  cksum=0x%04x\n",
           src_port, dst_port, length, checksum);

    /* Dispatch to upper-layer handlers */
    switch (dst_port) {
        case 53:  handle_dns(payload, data_len);  break;
        case 67:  handle_dhcp(payload, data_len); break;
        case 123: handle_ntp(payload, data_len);  break;
        default:  handle_unknown(payload, data_len);
    }
}

/* In VPP: UDP header accessed via vlib_buffer_get_current() */
/* after ip4-input has advanced past IP header */
udp_header_t *udp = vlib_buffer_get_current(b0);
u16 dst_port = clib_net_to_host_u16(udp->dst_port);

/* UDP pseudo-session in NGFW conntrack */
typedef struct {
    ip4_address_t  src_ip, dst_ip;
    uint16_t       src_port, dst_port;
    uint8_t        proto;                /* 17 = UDP */

    uint64_t       first_seen;           /* timestamp of first datagram */
    uint64_t       last_seen;            /* updated on each datagram */
    uint64_t       bytes_fwd;            /* client → server bytes */
    uint64_t       bytes_rev;            /* server → client bytes */
    uint8_t        state;                /* NEW / ESTABLISHED / TIMEOUT */
    uint32_t       timeout_sec;          /* idle timeout */
} udp_session_t;

/* UDP session lifecycle */
First datagram from client → create entry (state=NEW), apply policy
Reply datagram from server  → find entry by reversed 5-tuple, state=ESTABLISHED
No more datagrams for 30s  → sweep timer removes entry (default UDP timeout)

/* Different timeouts for different UDP protocols */
DNS:          5  seconds   /* DNS is one query + one reply */
DHCP:         30 seconds
NTP:          30 seconds
VoIP/RTP:    180 seconds   /* ongoing media stream */
Generic UDP:  30 seconds   /* catch-all default */

/* ICMP Echo Request (Type 8, Code 0) */
Type:       8
Code:       0
Checksum:   [computed]
Identifier: [process ID — matches request to reply if multiple pings running]
Sequence:   [increments with each ping — 1, 2, 3...]
Data:       [arbitrary payload — default 56 bytes on Linux = 64B ICMP total]

/* ICMP Echo Reply (Type 0, Code 0) */
Type:       0
Code:       0
Checksum:   [computed]
Identifier: [same as request]
Sequence:   [same as request]
Data:       [same bytes echoed back]

/* ping command usage */
ping -c 4 8.8.8.8           # send 4 pings
ping -s 1400 8.8.8.8        # send 1400-byte payload (test MTU)
ping -f -s 1472 8.8.8.8    # flood ping at max MTU size
ping -M do -s 1473 8.8.8.8  # force DF=1, will get "Frag needed" if MTU exceeded
ping6 2001:4860:4860::8888  # IPv6 ping (ICMPv6 Type 128/129)

/* Interpreting ping output */
64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=12.4 ms
#                                         ↑ TTL at receiver (started at some value, decremented by hops)
#                                                         ↑ round-trip time in ms

/* TTL tricks */
# TTL=117 → started at 128 (Windows hop) → 11 hops away
# TTL=52  → started at 64  (Linux hop)   → 12 hops away
# TTL=245 → started at 255 (router)      → 10 hops away

/* Linux traceroute algorithm (UDP mode, default) */
for ttl in 1..max_hops:
    send 3 UDP packets:
        IP: TTL = ttl, dst = target
        UDP: dst_port = 33434 + (ttl-1)*3  # incrementing port per probe
    wait for response:
        ICMP Type 11 Code 0 → TTL expired at THIS router
        ICMP Type 3 Code 3  → Port Unreachable from TARGET (destination reached)
        no reply within timeout → print "* * *"

    print: ttl, router_ip (from ICMP source), 3 RTTs

/* Windows tracert algorithm (ICMP mode) */
for ttl in 1..max_hops:
    send 3 ICMP Echo Request: TTL = ttl
    ICMP Type 11 Code 0 → intermediate router
    ICMP Type 0 → destination replied (done)

/* mtr (my traceroute) — continuous real-time version */
mtr --report --report-cycles 10 8.8.8.8

/* Interpreting traceroute anomalies */
Hop 5: * * *           # ICMP blocked or rate-limited — does NOT mean broken path
                        # subsequent hops may show fine
Hop 7: 192.168.x.x    # private address — NAT or misconfigured router
RTT spike at hop 8     # congestion at or beyond hop 8
RTT lower at hop 9     # asymmetric routing — return path is shorter
Same IP twice          # routing loop (rare with modern routing protocols)
Hop 3 → Hop 5 jump    # some hops don't respond to ICMP — skipped