[Bro] Bro Error: fatal error in <no location>: Val::CONVERTER (string/record)

Vlad Grigorescu vladg at cmu.edu
Tue Apr 15 06:02:52 PDT 2014


On Apr 15, 2014, at 8:36 AM, (peter) <45070198 at qq.com> wrote:

> event pop3_request(c: connection, is_orig: bool, command: string, arg: string) &priority=5
> {
>     Log::write(LOG, command);
> }

Command needs to be an Info record. You're passing a string. You'll need to fill out an Info record and log that.

>     type Info: record {
>         ts:      time     &log;
>         src:     addr     &log;
>         srcport: port     &log;
>         dst:     addr     &log;
>         dstport: port     &log;
>     };  

Take a look at the other Bro scripts. This isn't a good Bro Info record. You're even using different terminology (Bro doesn't have the concept of a "source" or "destination" - it's "originator" and "responder.")

  --Vlad
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 841 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140415/6a48caa0/attachment.bin 


More information about the Bro mailing list