[Bro-Dev] Check if table element exists

Aashish Sharma asharma at lbl.gov
Tue Aug 8 11:27:38 PDT 2017


(Not sure if I am interpreting your question right but here is how I read it) 

basically use "in" operator


local my_ip_table : table[addr] of bool ; 

local ip: addr = 127.0.0.1 

if ( ip in my_ip_table)
	found 
else 
	not found 


btw, you can also use "!in" operator too which is rather more handy 


if (something !in table)
	initialize it here
	table[something] = Blah; 


or 

most of scripts just flat return in membership doesn't exist that helps
eliminate a lot of unneeded run through scripts. 

if (ip !in Site::local_nets)
	return 

<do rest of the heuristics here for local IPs> 


Here is a (rather complicated but) useful example which stretches
above problem with an extended use-case:

/usr/local/bro/share/bro/policy/frameworks/software/vulnerable.bro

Hope this helps. Let me know if you need more clearifications. 

Aashish


On Tue, Aug 08, 2017 at 11:04:23AM -0700, Reinhard Gentz wrote:
> Hi,
> 
> I would like to check if a certain table element exists and then take
> corresponding action like the following:
> 
> if (exists(mytable["my_dynamic_name"]))
>     do something
> else
>     do something else
> 
> 
> Can someone give me a hint?
> Reinhard

> _______________________________________________
> bro-dev mailing list
> bro-dev at bro.org
> http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev



More information about the bro-dev mailing list