[Bro] Problem accessing additional Field in connection record

Tobias Limmer Tobias.Limmer at informatik.uni-erlangen.de
Mon Oct 20 09:21:01 PDT 2008


Hi everybody,

I've got a problem accessing a custom added field in the connection record.
My version of Bro is 1.3.2.

In detail:
I added a new field called "flow_start" inside the connection record in
file bro.init. This variable is also added in file Conn.h and Conn.cc to
fill it with an appropriate value in the constructor
Connection::Connection. Additionally, I changed file conn.bro to output the
content of the variable in function "record_connection". I'm doing this, as
I want to record the time of the first packet of the flow belonging to the
connection.
When I start Bro with "conn.bro" as parameter now, it starts working,
outputs a first connection correctly including my new field, but at the
second call of "record_connection", Bro exits with the error

1212999573.377278 ./conn.bro, line 211 (c$flow_start): internal error:
field value missing

What am I doing wrong? It seems that my variable is correctly set the first
time, but afterwards it isn't? It is strange, as the variable should always
be set in Connection::Connection.

I attached the (rather short) diff of my changes.


Thanks in advance & bye,
Tobi


-- 
Dipl.-Inf. Tobias Limmer
Computer Networks and Communication Systems
University of Erlangen-Nuremberg, Germany
Phone: +49 (9131) 85-27931  Fax: +49 (9131) 85-27409
eMail: tobias.limmer .at. informatik.uni-erlangen.de
WWW:   http://www7.informatik.uni-erlangen.de/~limmer
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: diff
Url: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20081020/4ff2dab5/attachment.ksh 


More information about the Bro mailing list