Rules (XIF)
[MODEL: dataset = radware_cloud_ddos_raw]
filter source_log_type = "security_events"
| alter
protocol = uppercase(protocol)
| alter
xdm.alert.subcategory = category,
xdm.alert.severity = risk,
xdm.alert.description = vectorName,
xdm.event.original_event_type = source_log_type,
xdm.event.duration = to_integer(duration),
xdm.event.is_completed = if(status = "Terminated" or status = "Occurred", to_boolean(true), to_boolean(false)),
xdm.observer.action = action,
xdm.observer.type = classification,
xdm.network.ip_protocol = if(protocol = "HOPOPT",XDM_CONST.IP_PROTOCOL_HOPOPT, protocol = "ICMP",XDM_CONST.IP_PROTOCOL_ICMP, protocol = "IGMP",XDM_CONST.IP_PROTOCOL_IGMP, protocol = "GGP",XDM_CONST.IP_PROTOCOL_GGP, protocol = "IP",XDM_CONST.IP_PROTOCOL_IP, protocol = "ST",XDM_CONST.IP_PROTOCOL_ST, protocol = "TCP",XDM_CONST.IP_PROTOCOL_TCP, protocol = "CBT",XDM_CONST.IP_PROTOCOL_CBT, protocol = "EGP",XDM_CONST.IP_PROTOCOL_EGP, protocol = "IGP",XDM_CONST.IP_PROTOCOL_IGP, protocol = "BBN_RCC_MON",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, protocol = "NVP_II",XDM_CONST.IP_PROTOCOL_NVP_II, protocol = "PUP",XDM_CONST.IP_PROTOCOL_PUP, protocol = "ARGUS",XDM_CONST.IP_PROTOCOL_ARGUS, protocol = "EMCON",XDM_CONST.IP_PROTOCOL_EMCON, protocol = "XNET",XDM_CONST.IP_PROTOCOL_XNET, protocol = "CHAOS",XDM_CONST.IP_PROTOCOL_CHAOS, protocol = "UDP",XDM_CONST.IP_PROTOCOL_UDP, protocol = "MUX",XDM_CONST.IP_PROTOCOL_MUX, protocol = "DCN_MEAS",XDM_CONST.IP_PROTOCOL_DCN_MEAS, protocol = "HMP",XDM_CONST.IP_PROTOCOL_HMP, protocol = "PRM",XDM_CONST.IP_PROTOCOL_PRM, protocol = "XNS_IDP",XDM_CONST.IP_PROTOCOL_XNS_IDP, protocol = "TRUNK_1",XDM_CONST.IP_PROTOCOL_TRUNK_1, protocol = "TRUNK_2",XDM_CONST.IP_PROTOCOL_TRUNK_2, protocol = "LEAF_1",XDM_CONST.IP_PROTOCOL_LEAF_1, protocol = "LEAF_2",XDM_CONST.IP_PROTOCOL_LEAF_2, protocol = "RDP",XDM_CONST.IP_PROTOCOL_RDP, protocol = "IRTP",XDM_CONST.IP_PROTOCOL_IRTP, protocol = "ISO_TP4",XDM_CONST.IP_PROTOCOL_ISO_TP4, protocol = "NETBLT",XDM_CONST.IP_PROTOCOL_NETBLT, protocol = "MFE_NSP",XDM_CONST.IP_PROTOCOL_MFE_NSP, protocol = "MERIT_INP",XDM_CONST.IP_PROTOCOL_MERIT_INP, protocol = "DCCP",XDM_CONST.IP_PROTOCOL_DCCP, protocol = "3PC",XDM_CONST.IP_PROTOCOL_3PC, protocol = "IDPR",XDM_CONST.IP_PROTOCOL_IDPR, protocol = "XTP",XDM_CONST.IP_PROTOCOL_XTP, protocol = "DDP",XDM_CONST.IP_PROTOCOL_DDP, protocol = "IDPR_CMTP",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, protocol = "TP",XDM_CONST.IP_PROTOCOL_TP, protocol = "IL",XDM_CONST.IP_PROTOCOL_IL, protocol = "IPV6",XDM_CONST.IP_PROTOCOL_IPV6, protocol = "SDRP",XDM_CONST.IP_PROTOCOL_SDRP, protocol = "IPV6_ROUTE",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, protocol = "IPV6_FRAG",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, protocol = "IDRP",XDM_CONST.IP_PROTOCOL_IDRP, protocol = "RSVP",XDM_CONST.IP_PROTOCOL_RSVP, protocol = "GRE",XDM_CONST.IP_PROTOCOL_GRE, protocol = "DSR",XDM_CONST.IP_PROTOCOL_DSR, protocol = "BNA",XDM_CONST.IP_PROTOCOL_BNA, protocol = "ESP",XDM_CONST.IP_PROTOCOL_ESP, protocol = "AH",XDM_CONST.IP_PROTOCOL_AH, protocol = "I_NLSP",XDM_CONST.IP_PROTOCOL_I_NLSP, protocol = "SWIPE",XDM_CONST.IP_PROTOCOL_SWIPE, protocol = "NARP",XDM_CONST.IP_PROTOCOL_NARP, protocol = "MOBILE",XDM_CONST.IP_PROTOCOL_MOBILE, protocol = "TLSP",XDM_CONST.IP_PROTOCOL_TLSP, protocol = "SKIP",XDM_CONST.IP_PROTOCOL_SKIP, protocol = "IPV6_ICMP",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, protocol = "IPV6_NONXT",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, protocol = "IPV6_OPTS",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, protocol = "CFTP",XDM_CONST.IP_PROTOCOL_CFTP, protocol = "SAT_EXPAK",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, protocol = "KRYPTOLAN",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, protocol = "RVD",XDM_CONST.IP_PROTOCOL_RVD, protocol = "IPPC",XDM_CONST.IP_PROTOCOL_IPPC, protocol = "SAT_MON",XDM_CONST.IP_PROTOCOL_SAT_MON, protocol = "VISA",XDM_CONST.IP_PROTOCOL_VISA, protocol = "IPCV",XDM_CONST.IP_PROTOCOL_IPCV, protocol = "CPNX",XDM_CONST.IP_PROTOCOL_CPNX, protocol = "CPHB",XDM_CONST.IP_PROTOCOL_CPHB, protocol = "WSN",XDM_CONST.IP_PROTOCOL_WSN, protocol = "PVP",XDM_CONST.IP_PROTOCOL_PVP, protocol = "BR_SAT_MON",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, protocol = "SUN_ND",XDM_CONST.IP_PROTOCOL_SUN_ND, protocol = "WB_MON",XDM_CONST.IP_PROTOCOL_WB_MON, protocol = "WB_EXPAK",XDM_CONST.IP_PROTOCOL_WB_EXPAK, protocol = "ISO_IP",XDM_CONST.IP_PROTOCOL_ISO_IP, protocol = "VMTP",XDM_CONST.IP_PROTOCOL_VMTP, protocol = "SECURE_VMTP",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, protocol = "VINES",XDM_CONST.IP_PROTOCOL_VINES, protocol = "TTP",XDM_CONST.IP_PROTOCOL_TTP, protocol = "NSFNET_IGP",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, protocol = "DGP",XDM_CONST.IP_PROTOCOL_DGP, protocol = "TCF",XDM_CONST.IP_PROTOCOL_TCF, protocol = "EIGRP",XDM_CONST.IP_PROTOCOL_EIGRP, protocol = "OSPFIGP",XDM_CONST.IP_PROTOCOL_OSPFIGP, protocol = "SPRITE_RPC",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, protocol = "LARP",XDM_CONST.IP_PROTOCOL_LARP, protocol = "MTP",XDM_CONST.IP_PROTOCOL_MTP, protocol = "AX25",XDM_CONST.IP_PROTOCOL_AX25, protocol = "IPIP",XDM_CONST.IP_PROTOCOL_IPIP, protocol = "MICP",XDM_CONST.IP_PROTOCOL_MICP, protocol = "SCC_SP",XDM_CONST.IP_PROTOCOL_SCC_SP, protocol = "ETHERIP",XDM_CONST.IP_PROTOCOL_ETHERIP, protocol = "ENCAP",XDM_CONST.IP_PROTOCOL_ENCAP, protocol = "GMTP",XDM_CONST.IP_PROTOCOL_GMTP, protocol = "IFMP",XDM_CONST.IP_PROTOCOL_IFMP, protocol = "PNNI",XDM_CONST.IP_PROTOCOL_PNNI, protocol = "PIM",XDM_CONST.IP_PROTOCOL_PIM, protocol = "ARIS",XDM_CONST.IP_PROTOCOL_ARIS, protocol = "SCPS",XDM_CONST.IP_PROTOCOL_SCPS, protocol = "QNX",XDM_CONST.IP_PROTOCOL_QNX, protocol = "AN",XDM_CONST.IP_PROTOCOL_AN, protocol = "IPCOMP",XDM_CONST.IP_PROTOCOL_IPCOMP, protocol = "COMPAQ_PEER",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, protocol = "IPX_IN_IP",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, protocol = "VRRP",XDM_CONST.IP_PROTOCOL_VRRP, protocol = "PGM",XDM_CONST.IP_PROTOCOL_PGM, protocol = "L2TP",XDM_CONST.IP_PROTOCOL_L2TP, protocol = "DDX",XDM_CONST.IP_PROTOCOL_DDX, protocol = "IATP",XDM_CONST.IP_PROTOCOL_IATP, protocol = "STP",XDM_CONST.IP_PROTOCOL_STP, protocol = "SRP",XDM_CONST.IP_PROTOCOL_SRP, protocol = "UTI",XDM_CONST.IP_PROTOCOL_UTI, protocol = "SMP",XDM_CONST.IP_PROTOCOL_SMP, protocol = "SM",XDM_CONST.IP_PROTOCOL_SM, protocol = "PTP",XDM_CONST.IP_PROTOCOL_PTP, protocol = "ISIS",XDM_CONST.IP_PROTOCOL_ISIS, protocol = "FIRE",XDM_CONST.IP_PROTOCOL_FIRE, protocol = "CRTP",XDM_CONST.IP_PROTOCOL_CRTP, protocol = "CRUDP",XDM_CONST.IP_PROTOCOL_CRUDP, protocol = "SSCOPMCE",XDM_CONST.IP_PROTOCOL_SSCOPMCE, protocol = "IPLT",XDM_CONST.IP_PROTOCOL_IPLT, protocol = "SPS",XDM_CONST.IP_PROTOCOL_SPS, protocol = "PIPE",XDM_CONST.IP_PROTOCOL_PIPE, protocol = "SCTP",XDM_CONST.IP_PROTOCOL_SCTP, protocol = "FC",XDM_CONST.IP_PROTOCOL_FC, protocol = "RSVP_E2E_IGNORE",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, protocol = "MOBILITY",XDM_CONST.IP_PROTOCOL_MOBILITY, protocol = "UDPLITE",XDM_CONST.IP_PROTOCOL_UDPLITE, protocol = "MPLS_IN_IP",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, protocol = null, null, to_string(protocol)),
xdm.source.sent_packets = to_integer(packetCount),
xdm.source.sent_bytes = to_integer(multiply(divide(to_integer(duration), 1000), to_integer(averageByteRate))),
xdm.source.port = to_integer(sourcePort),
xdm.source.ipv4 = arrayindex(regextract(sourceAddress, "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
xdm.source.ipv6 = arrayindex(regextract(sourceAddress, "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0),
xdm.target.ipv4 = arrayindex(regextract(targetAddress, "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
xdm.target.ipv6 = arrayindex(regextract(targetAddress, "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"),0),
xdm.target.port = to_integer(targetPort),
xdm.target.user.identifier = accountId,
xdm.target.user.username = accountName,
xdm.target.zone = siteName;
filter source_log_type = "operational_alerts"
| alter
extract_protocol = uppercase(context -> protocol),
extract_from_source_port = context -> fromSourcePort,
extract_to_source_port = context -> toSourcePort,
extract_from_target_port = context -> fromTargetPort,
extract_to_target_port = context -> toTargetPort,
extract_source_network = context -> sourceNetwork,
extract_target_network = context -> targetNetwork
| alter
check_target_port = if(extract_from_target_port = extract_to_target_port , extract_to_target_port, null),
check_source_port = if(extract_from_source_port = extract_to_source_port , extract_to_source_port, null),
validate_source_ipv4 = arrayindex(regextract(extract_source_network ,"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
check_source_ipv4_subnet = arrayindex(regextract(extract_source_network ,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/(\d+)"),0),
validate_source_ipv6 = arrayindex(regextract(extract_source_network ,"((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"),0),
check_source_ipv6_prefix = arrayindex(regextract(extract_source_network ,"(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}\/(\d+)"),0),
validate_target_ipv4 = arrayindex(regextract(extract_target_network ,"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"),0),
check_target_ipv4_subnet = arrayindex(regextract(extract_target_network ,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/(\d+)"),0),
validate_target_ipv6 = arrayindex(regextract(extract_target_network ,"((?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4})"),0),
check_target_ipv6_prefix = arrayindex(regextract(extract_target_network ,"(?:[a-fA-F\d]{0,4}\:){2,7}[a-fA-F\d]{0,4}\/(\d+)"),0)
| alter
xdm.alert.severity = severity,
xdm.alert.name = triggerName,
xdm.alert.description = concat(triggerDescription , ", Origin: ", triggerOrigin ),
xdm.event.original_event_type = source_log_type,
xdm.event.description = description,
xdm.source.port = to_integer(check_source_port),
xdm.source.ipv4 = if(check_source_ipv4_subnet ="32", validate_source_ipv4 , null),
xdm.source.ipv6 = if(check_source_ipv6_prefix ="64", validate_source_ipv6 , null),
xdm.target.ipv4 = if(check_target_ipv4_subnet = "32", validate_target_ipv4 , null),
xdm.target.ipv6 = if(check_target_ipv6_prefix ="64", validate_target_ipv6 , null),
xdm.target.port = to_integer(check_target_port),
xdm.target.user.identifier = accountId,
xdm.target.user.username = accountName,
xdm.target.zone = siteName,
xdm.network.rule = context,
xdm.network.ip_protocol = if(extract_protocol = "HOPOPT",XDM_CONST.IP_PROTOCOL_HOPOPT, extract_protocol = "ICMP",XDM_CONST.IP_PROTOCOL_ICMP, extract_protocol = "IGMP",XDM_CONST.IP_PROTOCOL_IGMP, extract_protocol = "GGP",XDM_CONST.IP_PROTOCOL_GGP, extract_protocol = "IP",XDM_CONST.IP_PROTOCOL_IP, extract_protocol = "ST",XDM_CONST.IP_PROTOCOL_ST, extract_protocol = "TCP",XDM_CONST.IP_PROTOCOL_TCP, extract_protocol = "CBT",XDM_CONST.IP_PROTOCOL_CBT, extract_protocol = "EGP",XDM_CONST.IP_PROTOCOL_EGP, extract_protocol = "IGP",XDM_CONST.IP_PROTOCOL_IGP, extract_protocol = "BBN_RCC_MON",XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, extract_protocol = "NVP_II",XDM_CONST.IP_PROTOCOL_NVP_II, extract_protocol = "PUP",XDM_CONST.IP_PROTOCOL_PUP, extract_protocol = "ARGUS",XDM_CONST.IP_PROTOCOL_ARGUS, extract_protocol = "EMCON",XDM_CONST.IP_PROTOCOL_EMCON, extract_protocol = "XNET",XDM_CONST.IP_PROTOCOL_XNET, extract_protocol = "CHAOS",XDM_CONST.IP_PROTOCOL_CHAOS, extract_protocol = "UDP",XDM_CONST.IP_PROTOCOL_UDP, extract_protocol = "MUX",XDM_CONST.IP_PROTOCOL_MUX, extract_protocol = "DCN_MEAS",XDM_CONST.IP_PROTOCOL_DCN_MEAS, extract_protocol = "HMP",XDM_CONST.IP_PROTOCOL_HMP, extract_protocol = "PRM",XDM_CONST.IP_PROTOCOL_PRM, extract_protocol = "XNS_IDP",XDM_CONST.IP_PROTOCOL_XNS_IDP, extract_protocol = "TRUNK_1",XDM_CONST.IP_PROTOCOL_TRUNK_1, extract_protocol = "TRUNK_2",XDM_CONST.IP_PROTOCOL_TRUNK_2, extract_protocol = "LEAF_1",XDM_CONST.IP_PROTOCOL_LEAF_1, extract_protocol = "LEAF_2",XDM_CONST.IP_PROTOCOL_LEAF_2, extract_protocol = "RDP",XDM_CONST.IP_PROTOCOL_RDP, extract_protocol = "IRTP",XDM_CONST.IP_PROTOCOL_IRTP, extract_protocol = "ISO_TP4",XDM_CONST.IP_PROTOCOL_ISO_TP4, extract_protocol = "NETBLT",XDM_CONST.IP_PROTOCOL_NETBLT, extract_protocol = "MFE_NSP",XDM_CONST.IP_PROTOCOL_MFE_NSP, extract_protocol = "MERIT_INP",XDM_CONST.IP_PROTOCOL_MERIT_INP, extract_protocol = "DCCP",XDM_CONST.IP_PROTOCOL_DCCP, extract_protocol = "3PC",XDM_CONST.IP_PROTOCOL_3PC, extract_protocol = "IDPR",XDM_CONST.IP_PROTOCOL_IDPR, extract_protocol = "XTP",XDM_CONST.IP_PROTOCOL_XTP, extract_protocol = "DDP",XDM_CONST.IP_PROTOCOL_DDP, extract_protocol = "IDPR_CMTP",XDM_CONST.IP_PROTOCOL_IDPR_CMTP, extract_protocol = "TP",XDM_CONST.IP_PROTOCOL_TP, extract_protocol = "IL",XDM_CONST.IP_PROTOCOL_IL, extract_protocol = "IPV6",XDM_CONST.IP_PROTOCOL_IPV6, extract_protocol = "SDRP",XDM_CONST.IP_PROTOCOL_SDRP, extract_protocol = "IPV6_ROUTE",XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, extract_protocol = "IPV6_FRAG",XDM_CONST.IP_PROTOCOL_IPV6_FRAG, extract_protocol = "IDRP",XDM_CONST.IP_PROTOCOL_IDRP, extract_protocol = "RSVP",XDM_CONST.IP_PROTOCOL_RSVP, extract_protocol = "GRE",XDM_CONST.IP_PROTOCOL_GRE, extract_protocol = "DSR",XDM_CONST.IP_PROTOCOL_DSR, extract_protocol = "BNA",XDM_CONST.IP_PROTOCOL_BNA, extract_protocol = "ESP",XDM_CONST.IP_PROTOCOL_ESP, extract_protocol = "AH",XDM_CONST.IP_PROTOCOL_AH, extract_protocol = "I_NLSP",XDM_CONST.IP_PROTOCOL_I_NLSP, extract_protocol = "SWIPE",XDM_CONST.IP_PROTOCOL_SWIPE, extract_protocol = "NARP",XDM_CONST.IP_PROTOCOL_NARP, extract_protocol = "MOBILE",XDM_CONST.IP_PROTOCOL_MOBILE, extract_protocol = "TLSP",XDM_CONST.IP_PROTOCOL_TLSP, extract_protocol = "SKIP",XDM_CONST.IP_PROTOCOL_SKIP, extract_protocol = "IPV6_ICMP",XDM_CONST.IP_PROTOCOL_IPV6_ICMP, extract_protocol = "IPV6_NONXT",XDM_CONST.IP_PROTOCOL_IPV6_NONXT, extract_protocol = "IPV6_OPTS",XDM_CONST.IP_PROTOCOL_IPV6_OPTS, extract_protocol = "CFTP",XDM_CONST.IP_PROTOCOL_CFTP, extract_protocol = "SAT_EXPAK",XDM_CONST.IP_PROTOCOL_SAT_EXPAK, extract_protocol = "KRYPTOLAN",XDM_CONST.IP_PROTOCOL_KRYPTOLAN, extract_protocol = "RVD",XDM_CONST.IP_PROTOCOL_RVD, extract_protocol = "IPPC",XDM_CONST.IP_PROTOCOL_IPPC, extract_protocol = "SAT_MON",XDM_CONST.IP_PROTOCOL_SAT_MON, extract_protocol = "VISA",XDM_CONST.IP_PROTOCOL_VISA, extract_protocol = "IPCV",XDM_CONST.IP_PROTOCOL_IPCV, extract_protocol = "CPNX",XDM_CONST.IP_PROTOCOL_CPNX, extract_protocol = "CPHB",XDM_CONST.IP_PROTOCOL_CPHB, extract_protocol = "WSN",XDM_CONST.IP_PROTOCOL_WSN, extract_protocol = "PVP",XDM_CONST.IP_PROTOCOL_PVP, extract_protocol = "BR_SAT_MON",XDM_CONST.IP_PROTOCOL_BR_SAT_MON, extract_protocol = "SUN_ND",XDM_CONST.IP_PROTOCOL_SUN_ND, extract_protocol = "WB_MON",XDM_CONST.IP_PROTOCOL_WB_MON, extract_protocol = "WB_EXPAK",XDM_CONST.IP_PROTOCOL_WB_EXPAK, extract_protocol = "ISO_IP",XDM_CONST.IP_PROTOCOL_ISO_IP, extract_protocol = "VMTP",XDM_CONST.IP_PROTOCOL_VMTP, extract_protocol = "SECURE_VMTP",XDM_CONST.IP_PROTOCOL_SECURE_VMTP, extract_protocol = "VINES",XDM_CONST.IP_PROTOCOL_VINES, extract_protocol = "TTP",XDM_CONST.IP_PROTOCOL_TTP, extract_protocol = "NSFNET_IGP",XDM_CONST.IP_PROTOCOL_NSFNET_IGP, extract_protocol = "DGP",XDM_CONST.IP_PROTOCOL_DGP, extract_protocol = "TCF",XDM_CONST.IP_PROTOCOL_TCF, extract_protocol = "EIGRP",XDM_CONST.IP_PROTOCOL_EIGRP, extract_protocol = "OSPFIGP",XDM_CONST.IP_PROTOCOL_OSPFIGP, extract_protocol = "SPRITE_RPC",XDM_CONST.IP_PROTOCOL_SPRITE_RPC, extract_protocol = "LARP",XDM_CONST.IP_PROTOCOL_LARP, extract_protocol = "MTP",XDM_CONST.IP_PROTOCOL_MTP, extract_protocol = "AX25",XDM_CONST.IP_PROTOCOL_AX25, extract_protocol = "IPIP",XDM_CONST.IP_PROTOCOL_IPIP, extract_protocol = "MICP",XDM_CONST.IP_PROTOCOL_MICP, extract_protocol = "SCC_SP",XDM_CONST.IP_PROTOCOL_SCC_SP, extract_protocol = "ETHERIP",XDM_CONST.IP_PROTOCOL_ETHERIP, extract_protocol = "ENCAP",XDM_CONST.IP_PROTOCOL_ENCAP, extract_protocol = "GMTP",XDM_CONST.IP_PROTOCOL_GMTP, extract_protocol = "IFMP",XDM_CONST.IP_PROTOCOL_IFMP, extract_protocol = "PNNI",XDM_CONST.IP_PROTOCOL_PNNI, extract_protocol = "PIM",XDM_CONST.IP_PROTOCOL_PIM, extract_protocol = "ARIS",XDM_CONST.IP_PROTOCOL_ARIS, extract_protocol = "SCPS",XDM_CONST.IP_PROTOCOL_SCPS, extract_protocol = "QNX",XDM_CONST.IP_PROTOCOL_QNX, extract_protocol = "AN",XDM_CONST.IP_PROTOCOL_AN, extract_protocol = "IPCOMP",XDM_CONST.IP_PROTOCOL_IPCOMP, extract_protocol = "COMPAQ_PEER",XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, extract_protocol = "IPX_IN_IP",XDM_CONST.IP_PROTOCOL_IPX_IN_IP, extract_protocol = "VRRP",XDM_CONST.IP_PROTOCOL_VRRP, extract_protocol = "PGM",XDM_CONST.IP_PROTOCOL_PGM, extract_protocol = "L2TP",XDM_CONST.IP_PROTOCOL_L2TP, extract_protocol = "DDX",XDM_CONST.IP_PROTOCOL_DDX, extract_protocol = "IATP",XDM_CONST.IP_PROTOCOL_IATP, extract_protocol = "STP",XDM_CONST.IP_PROTOCOL_STP, extract_protocol = "SRP",XDM_CONST.IP_PROTOCOL_SRP, extract_protocol = "UTI",XDM_CONST.IP_PROTOCOL_UTI, extract_protocol = "SMP",XDM_CONST.IP_PROTOCOL_SMP, extract_protocol = "SM",XDM_CONST.IP_PROTOCOL_SM, extract_protocol = "PTP",XDM_CONST.IP_PROTOCOL_PTP, extract_protocol = "ISIS",XDM_CONST.IP_PROTOCOL_ISIS, extract_protocol = "FIRE",XDM_CONST.IP_PROTOCOL_FIRE, extract_protocol = "CRTP",XDM_CONST.IP_PROTOCOL_CRTP, extract_protocol = "CRUDP",XDM_CONST.IP_PROTOCOL_CRUDP, extract_protocol = "SSCOPMCE",XDM_CONST.IP_PROTOCOL_SSCOPMCE, extract_protocol = "IPLT",XDM_CONST.IP_PROTOCOL_IPLT, extract_protocol = "SPS",XDM_CONST.IP_PROTOCOL_SPS, extract_protocol = "PIPE",XDM_CONST.IP_PROTOCOL_PIPE, extract_protocol = "SCTP",XDM_CONST.IP_PROTOCOL_SCTP, extract_protocol = "FC",XDM_CONST.IP_PROTOCOL_FC, extract_protocol = "RSVP_E2E_IGNORE",XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, extract_protocol = "MOBILITY",XDM_CONST.IP_PROTOCOL_MOBILITY, extract_protocol = "UDPLITE",XDM_CONST.IP_PROTOCOL_UDPLITE, extract_protocol = "MPLS_IN_IP",XDM_CONST.IP_PROTOCOL_MPLS_IN_IP, extract_protocol = null, null, to_string(extract_protocol));