[Bro] Access pcap filename in script land
valerio.click at gmx.com
Sun Mar 27 05:07:10 PDT 2016
I am trying to adapt the suggested methodology to the following
scenario: I have a custom main.bro script in
scripts/base/protocols/proto1/main.bro to which I would like to pass
arguments from command line each and every time I run bro with the
bro -r pcap_file_name.pcap
I set const arg1 =""&redef into main.bro but if I run
bro -r pcap_file_name.pcap 'arg1=\"test\"' I get the following error
error in <params>, line 1: unrecognized character - \
error in <params>, line 1: unrecognized character - "
error in <params>, line 1: unknown identifier test, at or near "test"
many thanks in advance,
On 16/03/2016 17:10, Valerio wrote:
> Thanks a lot!!!
>> Il giorno 16 mar 2016, alle ore 16:28, Robin Sommer <robin at icir.org> ha scritto:
>>> On Tue, Mar 15, 2016 at 20:47 +0100, Valerio wrote:
>>> Is it possible when I start bro to pass external arguments to a bro
>> Yes, you can override script variables, like this:
>> # cat args.bro
>> const pcap_file = "" &redef;
>> event bro_init()
>> # bro ./args.bro 'pcap_file=\"Foo\"'
>> Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin
> Bro mailing list
> bro at bro-ids.org
More information about the Bro