[Bro] Multi-dimensional Tables

Vern Paxson vern at icir.org
Mon Sep 27 23:49:39 PDT 2004


Good questions!

> global a: table[count] of table[addr] of port;
> 
> 1) How do I create yields for the overall table, i.e., how 
> do I create an object of type "table[addr] of port" ?
> 
> I want to eventually have: 
> 
> global a: table[count] of table[addr] of port = {
> 	[0] = XXX, 
> 	[1] = XXX, 
> };

You have to do it the way you listed:

> global a0: table[addr] of port;
> global a1: table[addr] of port;
> global a: table[count] of table[addr] of port = {
> 	[0] = a0, 
> 	[1] = a1, 
> };

because there's currently no way to "construct" a table using an expression
by itself (unlike record constructors, such as [$foo=1, $bar="hi"]).

> 2) When I define attributes for the table, which table is 
> affected, the total one, or the yield one?

The total one.

> If I define the original, total table as: 
> 
> global a: table[count] of table[addr] of port &write_expire= {
> 	[0] = a0, 
> 	[1] = a1, 
> };
> 
> and I don't modify any of the values in a0, will the full 
> a0 table expire, or just the values from a0? 

If you want to affect the yield table, define its own type:

	type yield_table: table[addr] of port &write_expire = 5 sec;
	global a: table[count] of yield_table = { ... }

- Vern



More information about the Bro mailing list