[Bro] Error SSL::Info server_name - not present

Bernhard Amann bernhard at ICSI.Berkeley.EDU
Fri Apr 4 05:24:10 PDT 2014


Hello Riccardo,

to check if a record entry is present, you can use the ?$ operator.

So - if ( c$ssl?$server_name) 
 do something…

Bernhard

On Apr 4, 2014, at 2:21 AM, Riccardo Bortolameotti <r.bortolameotti at gmail.com> wrote:

> Hello, 
> 
> I am a student, and I started few days ago to approach the bro's
> scripting language. 
> 
> I am writing a script that needs to get some information regarding SSL
> communications. In my script I do:
> - local server_n = c$ssl$server_name;
> - local subj = c$ssl$subject;
> Of course these fields are not always in the table (e.g. in SSLv3
> server_name does not exist, therefore no values), then my script raise a
> warning while it runs, saying that those values do not exist. 
> 
> What can I do to avoid that warning output?
> 
> I have tried to do some checks like:
> 
> if (c$ssl$server_name=="-" || c$ssl$server_name=="empty")
> 	do something ...
> 
> But it does not work, I do not know how it is represented it is not in
> the table.
> 
> thank you in advance,
> 
> glad to join this community,
> 
> R.
> 
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> 
> 





More information about the Bro mailing list