[Bro] Access pcap filename in script land

Azoff, Justin S jazoff at illinois.edu
Mon Mar 28 07:07:14 PDT 2016


> On Mar 28, 2016, at 10:01 AM, Valerio <valerio.click at gmx.com> wrote:
> 
> If I run bro -r pcap_file_name.pcap 'arg1="test"' I get the following error:
> 
> error in <params>, line 1: "redef" used but not previously defined (arg1)
> 
> regards,
> Valerio

That's because you did not define arg1... Also, 'arg1="test"' does not work. arg1=test works. 'arg1=test' would work. "arg1=test" would work, 'arg1="test"' does not work.

$ cat t.bro
const arg1 ="x" &redef ;

event bro_init() {
    print arg1;
}
$ bro t.bro
x
$ bro t.bro arg1=test
test
$ bro t.bro 'arg1=test two'
test two

-- 
- Justin Azoff




More information about the Bro mailing list