[Bro] Type conversion and table initialization
Mark Dedlow
mtdedlow at lbl.gov
Wed Feb 28 14:06:07 PST 2007
Robin Sommer wrote:
> On Tue, Feb 27, 2007 at 17:25 -0600, Mike Dopheide wrote:
>
>> I've got a udp packet that contains an IP address in the packet
>> contents[*].
>
> Hmmm... can't think of any other way than adding a new built-in
> ffunction specifically for this.
I think this is as simple as adding to bro.bif:
function hex_to_addr%(str: string%): addr
%{
int a,b,c,d;
int r;
r = sscanf(str->CheckString(), "%x.%x.%x.%x", &a, &b, &c, &d);
if ( r != 4 )
run_time("hex addr not parseable");
return new AddrVal(dotted_to_addr(fmt("%d.%d.%d.%d", a,b,c,d)));
%}
You may need to tweak the format, eg, for the \x format, to something
like "\\x%x\\x%x\\x%x\\x%x".
Mark
More information about the Bro
mailing list