[Bro-Dev] #968: Add bytestring_to_uint16, uint32, uint64 functions

Bro Tracker bro at tracker.bro.org
Mon Apr 22 09:56:21 PDT 2013


#968: Add bytestring_to_uint16, uint32, uint64 functions
--------------------+------------------------
  Reporter:  yun    |      Owner:
      Type:  Patch  |     Status:  new
  Priority:  Low    |  Milestone:  Bro2.2
 Component:  Bro    |    Version:  git/master
Resolution:         |   Keywords:  bytestring
--------------------+------------------------

Comment (by jsiwek):

 Replying to [comment:31 yun]:
 > Replying to [comment:30 robin]:
 > > Thinking about it, would it be better to switch the boolean to
 > > indicate host- vs. network-byte order, rather than big-endian vs
 > > low-endian?
 >
 > I think that would not work as that would make the bro script platform
 dependent. So for example using the bro script on a little endian platform
 would read the bytestream differently on a big endian platform if you
 specified host order.

 If a bytestring is parsed from some network traffic and delivered to the
 script-layer, it's either going to be in host order or network order and
 usually no one has to care the endianness that's behind those if they've
 got access to `hton*/ntoh*` functions that will hide any of the byte
 swapping that may be needed.

 So I think it makes more sense for a `bytestring_to_count` function to
 have a boolean flag for network vs. host order (instead of big vs. little
 endian).

 Or has endianness explicitly been exposed to the script-layer for some
 reason in your case?

-- 
Ticket URL: <http://tracker.bro.org/bro/ticket/968#comment:33>
Bro Tracker <http://tracker.bro.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list