[Bro-Dev] Check if table element exists

[Reinhard Gentz]

Thank you! Exactly what I was looking for

On Tue, Aug 8, 2017 at 11:27 AM, Aashish Sharma <asharma at lbl.gov> wrote:

> (Not sure if I am interpreting your question right but here is how I read
> it)
>
> basically use "in" operator
>
>
> local my_ip_table : table[addr] of bool ;
>
> local ip: addr = 127.0.0.1
>
> if ( ip in my_ip_table)
>         found
> else
>         not found
>
>
> btw, you can also use "!in" operator too which is rather more handy
>
>
> if (something !in table)
>         initialize it here
>         table[something] = Blah;
>
>
> or
>
> most of scripts just flat return in membership doesn't exist that helps
> eliminate a lot of unneeded run through scripts.
>
> if (ip !in Site::local_nets)
>         return
>
> <do rest of the heuristics here for local IPs>
>
>
> Here is a (rather complicated but) useful example which stretches
> above problem with an extended use-case:
>
> /usr/local/bro/share/bro/policy/frameworks/software/vulnerable.bro
>
> Hope this helps. Let me know if you need more clearifications.
>
> Aashish
>
>
> On Tue, Aug 08, 2017 at 11:04:23AM -0700, Reinhard Gentz wrote:
> > Hi,
> >
> > I would like to check if a certain table element exists and then take
> > corresponding action like the following:
> >
> > if (exists(mytable["my_dynamic_name"]))
> >     do something
> > else
> >     do something else
> >
> >
> > Can someone give me a hint?
> > Reinhard
>
> > _______________________________________________
> > bro-dev mailing list
> > bro-dev at bro.org
> > http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.icsi.berkeley.edu/pipermail/bro-dev/attachments/20170808/0e9647bf/attachment.html