[Bro] Clarification needed

PeLo phrackmod at gmail.com
Fri Sep 19 13:53:42 PDT 2014


Regaring *“exit_only_after_terminate”*, does the execution repeat a
specific loop until it satisfies the condition?? As per the logic, it
should be repeating the loop from the statement right after the when
statement. Could you clear me on this.

On Sat, Sep 20, 2014 at 1:52 AM, Siwek, Jon <jsiwek at illinois.edu> wrote:

>
> On Sep 19, 2014, at 2:43 PM, PeLo <phrackmod at gmail.com> wrote:
>
> >       ### Error occurs here
> >       ### Error Output
> >       ### ============
> >       ### error : type clash (addr and
> {74.125.236.213,2404:6800:4007:803::1015})
> >       ### error : type mismatch
> ({74.125.236.213,2404:6800:4007:803::1015} and addr)
> >
> >       local google_ips: set[addr] = { mail.google.com, maps.google.com,
> youtube.com };
> >       for (i in google_ips)   print(i);
>
> Moving the declaration up in to a global makes it work for me.
>
> >       ### No errors and output here
> >       ### Anything wrong with the code???
> >
> >       local ip_list: set[addr];
> >       local domain_list: set[string] = { "google.com", "bro.org" };
> >
> >       for (domain in domain_list){
> >               when( local temp = lookup_hostname(domain) ){
> >                       for (ip in temp)
> >                               add ip_list[ip];
> >               }
> >       }
> >       for (i in ip_list)      print(i);
> > }
>
> In the absence of input sources (e.g. reading live traffic), it may
> terminate before the lookup returns. The way to tell it not to do that is
> to redef “exit_only_after_terminate”.  Then you also have do the printing
> within the body of the when statement as that’s when results are actually
> available.  For example see:
>
> http://try.bro.org/#/trybro/saved/46c2c025-6462-41e2-a581-14a9c3eba656
>
> - Jon
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140920/636bf760/attachment.html 


More information about the Bro mailing list