[Bro] Clarification needed

Siwek, Jon jsiwek at illinois.edu
Fri Sep 19 13:22:58 PDT 2014


On Sep 19, 2014, at 2:43 PM, PeLo <phrackmod at gmail.com> wrote:

> 	### Error occurs here
> 	### Error Output
> 	### ============
> 	### error : type clash (addr and {74.125.236.213,2404:6800:4007:803::1015})
> 	### error : type mismatch ({74.125.236.213,2404:6800:4007:803::1015} and addr)
> 	
> 	local google_ips: set[addr] = { mail.google.com, maps.google.com, youtube.com };
> 	for (i in google_ips)	print(i);

Moving the declaration up in to a global makes it work for me.

> 	### No errors and output here
> 	### Anything wrong with the code??? 
> 
> 	local ip_list: set[addr];
> 	local domain_list: set[string] = { "google.com", "bro.org" };
> 	
> 	for (domain in domain_list){
> 		when( local temp = lookup_hostname(domain) ){
> 			for (ip in temp)
> 				add ip_list[ip];
> 		}
> 	}
> 	for (i in ip_list)	print(i);
> }

In the absence of input sources (e.g. reading live traffic), it may terminate before the lookup returns. The way to tell it not to do that is to redef “exit_only_after_terminate”.  Then you also have do the printing within the body of the when statement as that’s when results are actually available.  For example see:

http://try.bro.org/#/trybro/saved/46c2c025-6462-41e2-a581-14a9c3eba656

- Jon



More information about the Bro mailing list