[Bro] error declaring a record

Earl Eiland earl.eiland at root9b.com
Wed Aug 5 06:47:45 PDT 2015

For any others that may run into a similar situation, ‘conversation’ is a reserved word In bro.  The problem disappeared when I renamed the variable.


From: bro-bounces at bro.org [mailto:bro-bounces at bro.org] On Behalf Of Earl Eiland
Sent: Tuesday, August 4, 2015 2:35 PM
To: bro at bro.org
Subject: [Bro] error declaring a record

I’m declaring a record, and bro is reporting a syntax error ‘at or near “type”’.

I’ve compared my code to functional scripts, and can find examples where variables are declared as type “addr”.  However, the code below does not work ☹.  I can replace the “addr” type with “string” and the declaration is accepted.

    redef enum Log::ID += {LOG};

type Service_observed_key: record
    conversation:  addr;

Please advise!

Earl Eiland,
Sr. Cyber Security Engineer,
Emerging Technologies, root9B,
San Antonio, Texas

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150805/75431090/attachment.html 

More information about the Bro mailing list