[Bro] Problem accessing additional Field in connection record
Tobias Limmer
Tobias.Limmer at informatik.uni-erlangen.de
Mon Oct 20 09:21:01 PDT 2008
Hi everybody,
I've got a problem accessing a custom added field in the connection record.
My version of Bro is 1.3.2.
In detail:
I added a new field called "flow_start" inside the connection record in
file bro.init. This variable is also added in file Conn.h and Conn.cc to
fill it with an appropriate value in the constructor
Connection::Connection. Additionally, I changed file conn.bro to output the
content of the variable in function "record_connection". I'm doing this, as
I want to record the time of the first packet of the flow belonging to the
connection.
When I start Bro with "conn.bro" as parameter now, it starts working,
outputs a first connection correctly including my new field, but at the
second call of "record_connection", Bro exits with the error
1212999573.377278 ./conn.bro, line 211 (c$flow_start): internal error:
field value missing
What am I doing wrong? It seems that my variable is correctly set the first
time, but afterwards it isn't? It is strange, as the variable should always
be set in Connection::Connection.
I attached the (rather short) diff of my changes.
Thanks in advance & bye,
Tobi
--
Dipl.-Inf. Tobias Limmer
Computer Networks and Communication Systems
University of Erlangen-Nuremberg, Germany
Phone: +49 (9131) 85-27931 Fax: +49 (9131) 85-27409
eMail: tobias.limmer .at. informatik.uni-erlangen.de
WWW: http://www7.informatik.uni-erlangen.de/~limmer
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: diff
Url: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20081020/4ff2dab5/attachment.ksh
More information about the Bro
mailing list