[Bro-Dev] #374: Add type testing operator

Bro Tracker bro at tracker.icir.org
Thu Feb 3 14:20:39 PST 2011

#374: Add type testing operator
  Reporter:  seth             |      Owner:
      Type:  Feature Request  |     Status:  new
  Priority:  Normal           |  Milestone:  Bro1.6
 Component:  Bro              |    Version:
Resolution:                   |   Keywords:  logging

Comment (by robin):

 On Thu, Feb 03, 2011 at 22:05 -0000, you wrote:

 >  didn't consider the difference in what's returned.  The question we
 >  haven't asked yet I don't think is what happens in the case that cid is
 >  not of type conn_id?

 A run_time error I would say, with aborting the function.

 About the only use case I envision for this is when one knows for sure
 what field (w/ type) the record should have, and using the operator
 then just acts as dynamic check to make sure that's indeed the case;
 if it's not, that's a bug in the script because the function shouldn't
 have been called in the first place.

 That's also why I don't think I'd add a boolean "query operator" in
 addition (like the `rec?$<conn_id>cid`) as that would only encourage
 using it for dynamic dispatching based on type, which I don't really

Ticket URL: <http://tracker.icir.org/bro/ticket/374#comment:4>
Bro Tracker <http://tracker.icir.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list