[Bro] testing against uninitialized fields

[Aaron Gee-Clough]

Try:

   if (connection?$service){
      <do stuff that relies on service field>
   }

or if you'd prefer to explicitly bail out if it's not there:

   if (!connection?$service){return;}



aaron

On 08/18/2015 02:49 PM, Earl Eiland wrote:
> I’m writing a script that works with the connection$service field. 
> Sometimes, this field is unintialized, which is causing my script to
> fail.  How can I catch an unintialized field?
> 
>  
> 
> Best Regards,
> 
>  
> 
> Earl Eiland,
> 
> Sr. Cyber Security Engineer,
> 
> Emerging Technologies, root9B,
> 
> San Antonio, Texas
> 
>  
> 
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity named.  If you
> are not the named addressee you are notified that disclosing, copying,
> distributing or taking any action in reliance on the contents of this
> information is strictly prohibited.  Please notify the sender
> immediately by email if you received this email in error and delete this
> email from your system. Any views or opinions presented in this e-mail
> are solely those of the author and do not necessarily represent those of
> root9B LLC.​
> 
>  
> 
> 
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>