# $Id: udp.bro,v 1.12 2002/10/13 21:07:59 vern Exp $

@load hot
@load conn
@load scan

global udp_req_count: table[conn_id] of count &default = 0;
global udp_rep_count: table[conn_id] of count &default = 0;
global udp_did_summary: table[conn_id] of count &default = 0;

event udp_request(u: connection)
	{
	check_scan(u, F, F);
	check_hot(u, CONN_ATTEMPTED);
	record_connection(u, "request");
	}

event udp_reply(u: connection)
	{
	check_scan(u, T, F);
	check_hot(u, CONN_ESTABLISHED);
	check_hot(u, CONN_FINISHED);
	record_connection(u, "reply");
	}

function add_req_rep_addl(u: connection)
	{
	local id = u$id;
	if ( udp_req_count[id] > 1 || udp_rep_count[id] > 1 )
		append_addl(u, fmt("[%d/%d]", udp_req_count[id], udp_rep_count[id]));

	delete udp_req_count[id];
	delete udp_rep_count[id];
	}

event udp_session_done(u: connection)
	{
	if ( u$id !in udp_did_summary )
		{
		add_req_rep_addl(u);
		check_hot(u, CONN_FINISHED);
		record_connection(u, "session");
		}

	else
		delete udp_did_summary[u$id];
	}

# event connection_timeout(c: connection)
# 	{
# 	if ( ! is_tcp_port(c$id$orig_p) )
# 		{
# 		add_req_rep_addl(c);
# 		connection_gone(c, "timeout");
# 		++udp_did_summary[c$id];
# 		}
# 	}
