[Bro] null set question

Johanna Amann johanna at icir.org
Tue Oct 18 12:55:59 PDT 2016



On 18 Oct 2016, at 8:10, erik clark wrote:

> I can't find any test to do null set evaluation, let alone null string
> evaluation. For null sets, I am doing
>
> local set_count = |set|;
> if (set_count == 0) ...
>
> Shouldn't there be a proper is null way of doing this? I can't find it 
> in
> the bro scripting documentation.

The way that you found is the way to do it. So - just check if the 
length of the string/vector/set is null. You can also do that in a 
single line without using a separate variable.

Is there a specific reason why you want a different way of doing that?

Johanna


More information about the Bro mailing list