[Bro] port field in file input

Michael Wenthold michael.wenthold at gmail.com
Wed Jun 18 11:20:59 PDT 2014


Is there anything that prevents me from loading data from a file with an
idx type "port"?

I'm trying to put the data in a file:

#fields tgt_port        tgt_subnet
#types  port    subnet
5222/tcp        74.127.0.0/24

but when my script tries to load the file I get the following error:
Input::READER_ASCII: Number '5222/tcp' contained non-numeric trailing
characters. Ignored trailing characters '/tcp'

The file reader table idx types are all set to type "port".  I know I can
just put all of the information in the script instead of offloading it to a
file, but I don't see anything that would prevent me from offloading the
information to a file.  I feel like I'm missing something really basic, but
I'm definitely missing something.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140618/0c6c779b/attachment.html 


More information about the Bro mailing list