[Bro] confusing error on if statement

anthony kasza anthony.kasza at gmail.com
Mon Aug 17 12:33:34 PDT 2015


Hi Earl,

Are you able to include the script here?

-AK
On Aug 17, 2015 8:16 AM, "Earl Eiland" <earl.eiland at root9b.com> wrote:

> I’m testing to see if c$service is a subset of a set[string] field in a
> table, and getting the error message
>
>
>
> “error in string and ./bro_scripts/Screen_protocols.bro, line 79: type
> clash (string and Screen_protocols::c$service)
>
> error in ./bro_scripts/Screen_protocols.bro, line 79 and string: type
> mismatch (Screen_protocols::c$service and string)
>
> error in ./bro_scripts/Screen_protocols.bro, line 79: not an index type
> (Screen_protocols::c$service in
> Screen_protocols::whitelist[Screen_protocols::c$id$orig_h,
> Screen_protocols::c$id$resp_h]$service)”
>
>
>
> The command is: “if (c$service !in whitelist[c$id$orig_h,
> c$id$resp_h]$service)”
>
> Where the table is defined as “global whitelist: table[addr, addr] of
> Service_whitelist_data = table();” and the table field service is defined
> as “service: set[string];”
>
>
>
> Please advise!
>
>
>
> Best Regards,
>
>
>
> Earl Eiland,
>
> Sr. Cyber Security Engineer,
>
> Emerging Technologies, root9B,
>
> San Antonio, Texas
>
>
>
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150817/71a1be82/attachment.html 


More information about the Bro mailing list