[Bro] howto: getting the port number only

Robin Sommer robin at icir.org
Tue Sep 18 19:54:06 PDT 2007


On Tue, Sep 18, 2007 at 15:40 +0800, mel at hackinthebox.org wrote:

> However, I'm only interested in the port number, not the protocol. How do
> I get the port number only?

This gives you the port as a string: 

     fmt("%d", 42/tcp)

Robin

-- 
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org



More information about the Bro mailing list