[Bro-Dev] Broccoli question

Randy Caldejon randy at packetchaser.org
Thu Dec 19 12:49:05 PST 2013


Hi,

Can somebody tell me if BRO_TYPE_TABLE is supported at part of a record?  More specifically, I want to send records that look something like this to Bro using Broccoli.

	type example_record: record
	{
    		uid:        string;
    		hash:  table [string] of string;
	};

However, my implementation core dumps when the following is called (after populating hashTable with key/value pairs):

	BroTable *hashTable = bro_table_new();
	.
	.
	.
	 bro_record_add_val(rec, "hash", BRO_TYPE_TABLE, NULL, hashTable);
	.
	.
	bro_event_add_val(ev, BRO_TYPE_RECORD, NULL, rec);

I could not find any examples in the docs or test library on how to include a table as a field in a record.

Thanks,

Randy





More information about the bro-dev mailing list