[Bro-Dev] mask_addr?

Seth Hall seth at icir.org
Fri Jul 22 20:19:48 PDT 2011

I think the existing mask_addr function may be named wrong.  Here's the current prototype:
	function mask_addr(a: addr, top_bits_to_keep: count): addr

I want it to do this (and I think it makes more sense based on the name):
	function mask_addr(a: addr, top_bits_to_keep: count): subnet 

I'm not sure how the existing function was ever used, but it seems like it must have been a fairly limited use case.  Does that seem reasonable to change what that function does and steal the name?  I suppose the existing function could be renamed to something else if someone still knows of a use for it.

In case it's not obvious from the prototypes above, what I'm aiming to do is take addresses and mask them off to subnets (I need it for aggregation with the metrics framework).
For example...
print mask_addr(, 24)


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the bro-dev mailing list