[Bro] [Bro type clash]

Daniel Guerra daniel.guerra69 at gmail.com
Thu Nov 24 10:35:39 PST 2016


Check if present first.
if (n$id?orig_h)
 if (n$id$orig_h =

Regards,

Daniel
> On 24 Nov 2016, at 19:23, Zeolla at GMail.com <zeolla at gmail.com> wrote:
> 
> Have you tried n$id?$orig_h ?  Should return true if it is set.  Are you concerned that it may contain something but it isn't a valid IP? 
> 
> Also, I believe "-" is just a representation of an unset field for the log output. https://www.bro.org/sphinx/scripts/base/frameworks/logging/writers/ascii.bro.html#id-LogAscii::unset_field <https://www.bro.org/sphinx/scripts/base/frameworks/logging/writers/ascii.bro.html#id-LogAscii::unset_field>
> On Thu, Nov 24, 2016, 13:06 Eugene Dautzenberg <edautz at gmail.com <mailto:edautz at gmail.com>> wrote:
> I want to check if
> 
> n$id$orig_h
> 
> contains a valid ip address.
> 
> But when I use and if comparison something like.
> 
> If ( n$id$orig_h = "-" )
> 
> I got a type clash (string and cmd) error.
> 
> How to solve this?
> 
> Thx
> 
> Verstuurd vanaf mijn iPhone
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org <mailto:bro at bro-ids.org>
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro <http://mailman.icsi.berkeley.edu/mailman/listinfo/bro>
> -- 
> Jon
> 
> Sent from my mobile device
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161124/03e513bb/attachment.html 


More information about the Bro mailing list