[Bro] problem with &expire_func

Christoph Goeldi goeldich at ee.ethz.ch
Thu Feb 10 02:55:01 PST 2005

hi there

i found another problem with bro.
this time it is the expire_func which makes trouble.
when i have a policy file like this:

> global mytable: table[addr] of bool &write_expire=10sec &expire_func=myfunc;
> function myfunc(t: table[addr] of bool , idx: any): interval {
>     local srcIP: addr;
 >     print network_time(),"help!!!";
>     [srcIP] = idx;
>     return 0secs;
> }

it ends in an error like this:

> 1108032092.49407, help!!!
> 1108032092.494068 <no location> ( bad tag in Val::CONVERTER

i tested several constellations and noticed, that it is impossible to 
use idx when a table has only one index.

any help welcome.

More information about the Bro mailing list