[Bro] [Bro type clash]
Daniel Guerra
daniel.guerra69 at gmail.com
Thu Nov 24 10:35:39 PST 2016
Check if present first.
if (n$id?orig_h)
if (n$id$orig_h =
Regards,
Daniel
> On 24 Nov 2016, at 19:23, Zeolla at GMail.com <zeolla at gmail.com> wrote:
>
> Have you tried n$id?$orig_h ? Should return true if it is set. Are you concerned that it may contain something but it isn't a valid IP?
>
> Also, I believe "-" is just a representation of an unset field for the log output. https://www.bro.org/sphinx/scripts/base/frameworks/logging/writers/ascii.bro.html#id-LogAscii::unset_field <https://www.bro.org/sphinx/scripts/base/frameworks/logging/writers/ascii.bro.html#id-LogAscii::unset_field>
> On Thu, Nov 24, 2016, 13:06 Eugene Dautzenberg <edautz at gmail.com <mailto:edautz at gmail.com>> wrote:
> I want to check if
>
> n$id$orig_h
>
> contains a valid ip address.
>
> But when I use and if comparison something like.
>
> If ( n$id$orig_h = "-" )
>
> I got a type clash (string and cmd) error.
>
> How to solve this?
>
> Thx
>
> Verstuurd vanaf mijn iPhone
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org <mailto:bro at bro-ids.org>
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro <http://mailman.icsi.berkeley.edu/mailman/listinfo/bro>
> --
> Jon
>
> Sent from my mobile device
>
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161124/03e513bb/attachment.html
More information about the Bro
mailing list