[Bro] arp_main.bro : "Reporter::ERROR no such index"

[Jon Siwek]

On Mon, Jan 29, 2018 at 4:45 AM, Nicolas KRASINSKI <krasinski at cines.fr> wrote:

> I try to use the script arp_main.bro, that I found here :
> https://gist.github.com/grigorescu/a28b814a8fb626e2a7b4715d278198aa
> I can load this script without error, but I have an error in my reporter.log
> :
>
> Reporter::ERROR no such index (ARP::arp_states[ARP::SHA])
> /usr/local/bro/spool/installed-scripts-do-not-touch/site/arp_main.bro, line
> 186
>
> In the script, the error is on the line 186 :
>
> 181 event arp_request(mac_src: string, mac_dst: string, SPA: addr, SHA:
> string, TPA: addr, THA: string)
> 182 {
> 183 mac_addr_association(SHA, SPA);
> 184
> 185 local arp_state: State;
> 186 arp_state = arp_states[SHA];
>
> I don't understand how to solve this problem, could you help me ?

To get rid of that error, the code needs to be fixed/rewritten.  It
might be as simple as putting 'if ( SHA !in arp_states ) return;'
after line 183 or it might not be, one would have to read/understand
the code more closely to determine how to fix it.  If you don't get
more of a response in this list, you could try contacting the author
of the script directly (their name/email is at the top of it) to see
if they have any changes/updates, else you could try fixing the code
yourself.

- Jon