From 2bd2bf87cc508462f98d907722dc9ee9d3befbe4 Mon Sep 17 00:00:00 2001
From: david <david@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Fri, 14 Aug 2009 17:26:08 +0000
Subject: [PATCH] Add a UDP payload for port 520/udp, route.

---
 payload.cc | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/payload.cc b/payload.cc
index f3554b477..2a170d067 100644
--- a/payload.cc
+++ b/payload.cc
@@ -131,6 +131,13 @@ static const char payload_SNMPv3GetRequest[] =
    http://cgit.freedesktop.org/xorg/doc/xorg-docs/plain/hardcopy/XDMCP/xdmcp.PS.gz */
 static const char payload_xdmcp[] = "\000\001\000\002\000\001\000";
 
+/* Routing Information Protocol version 1. Special-case request for the entire
+   routing table (address family 0, address 0.0.0.0, metric 16). RFC 1058,
+   section 3.4.1. */
+static const char payload_rip[] =
+  "\001\001\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
+  "\000\000\000\000\000\000\000\020";
+
 /*
 This one trips a Snort rule with SID 2049 ("MS-SQL ping attempt").
 static const char payload_Sqlping[] = "\002";
@@ -181,6 +188,9 @@ const char *udp_port2payload(u16 dport, size_t *length){
     case 177:
       SET_PAYLOAD(payload_xdmcp);
       break;
+    case 520:
+      SET_PAYLOAD(payload_rip);
+      break;
     /*
     case 1434:
       SET_PAYLOAD(payload_Sqlping);