[Bro] problem with &expire_func

Christoph Goeldi goeldich at ee.ethz.ch
Thu Feb 10 02:55:01 PST 2005


hi there


i found another problem with bro.
this time it is the expire_func which makes trouble.
when i have a policy file like this:

> global mytable: table[addr] of bool &write_expire=10sec &expire_func=myfunc;
> 
> function myfunc(t: table[addr] of bool , idx: any): interval {
>     local srcIP: addr;
>     
 >     print network_time(),"help!!!";
>     [srcIP] = idx;
> 
>     return 0secs;
> }


it ends in an error like this:

> 1108032092.49407, help!!!
> 1108032092.494068 <no location> (192.168.0.75): bad tag in Val::CONVERTER


i tested several constellations and noticed, that it is impossible to 
use idx when a table has only one index.


any help welcome.
thanx
christoph



More information about the Bro mailing list