[Bro] Two-dimensional arrays and for loop in Bro

Christian Kreibich christian at whoop.org
Tue Mar 13 14:35:11 PDT 2007

Hi Abhinay,

On Fri, 2007-02-23 at 20:05 -0600, Abhinay Kampasi wrote:
> Hi,
> I need to use two-dimensional (2D) arrays and for loops in one of my policy
> scripts. Could someone please clarify the following questions for me.
> 1. I am thinking of implementing 2D arrays as table of tables. Is this the
> best of doing this? Is "array[][]" in C equivalent to "global array:
> table[count] of table[count] of count" in Bro?

No, it's most closely related to a vector of vectors, much like in C.

> Can I access an element of
> this array as array[index1][index2]?

Yes, assuming the structure located at array[index1] is defined.

> Also, is there a short-hand notation of
> initializing all the elements of the 2D array to 0?

Not at the moment, no, since it'll depend on what size you want the
matrix to be.

> 2. The reference manual mentions that Bro lacks ways of controlling the
> order in which it iterates over the indices in a for loop. I need to iterate
> over a for loop in order. What is the best way of doing this?

You can avoid this by using vectors. The code snippet below uses
recursion to work around the lack of a numeric for-loop and will print

m[1,1] = 1
m[1,2] = 0
m[1,3] = 0
m[2,1] = 0
m[2,2] = 2
m[2,3] = 0
m[3,1] = 0
m[3,2] = 0
m[3,3] = 3

type mrow: vector of count;
type matrix: vector of mrow;

function matrix_row_init(r: mrow, col: count)
        r[col] = 0;

        if (col > 1)
                matrix_row_init(r, col-1);

function matrix_init(m: matrix, row: count, cols: count)
        local r: mrow;
        matrix_row_init(r, cols);
        m[row] = r;

        if (row > 1)
                matrix_init(m, row-1, cols);

function matrix_new(rows: count, cols: count): matrix
        local m: matrix;
        matrix_init(m, rows, cols);
        return m;

event bro_init() {
        local m: matrix = matrix_new(3, 3);

        m[1][1] = 1;
        m[2][2] = 2;
        m[3][3] = 3;

        for (r in m) {
                for (c in m[r]) {
                        print fmt("m[%d,%d] = %d", r, c, m[r][c]);

Note that while you have to do the assignment of rows to the matrix
vector, you can save yourself the assignment of counts to each position
in a row if you know you'll always be assigning values before using
them. I also have no idea how slow/fast the above code will be for
nontrivial matrix sizes. :)


More information about the Bro mailing list