[Bro] initial buffer length

Abdelkarim benkhadra a.benkhadra at hotmail.com
Wed May 27 04:52:13 PDT 2015


in myproto-protocol.pac, i have:

type myproto_PDU(is_orig: bool) = record {
  header: myproto_Header;
} &length=header.msgSize;

type myproto_Header = record {
  //some fields;
  msgSize: uint16;
msgSize represents the length of the PDU.
and when "make"ing bro i get "cannot determine initial buffer length for type myproto_PDU".
i tryed some random values like &length=60 and it works fine.
i took the modbus analyzer as an exemple to write myproto analyzer but without success.
any ideas?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150527/469b3742/attachment.html 

More information about the Bro mailing list