[Bro] Allocating Dynamic Bytestring Length

TQ nothinrandom at gmail.com
Mon Nov 26 14:34:20 PST 2018


Hello There,

I have some data that is delimited by a comma, but the data length could
vary in between. For example:

1) A,B,C,D,E
2) AA,BBB,C,DDDDD,EE
3) AAA,BB,CCCCCCCC,DD,EEE

I was thinking of using bytestring inside the record and have it read until
each delimiter... something like...

type My_Data = record {

field1 : bytestring & length=readuntil 0x2c;
field2 : bytestring & length=readuntil 0x2c;
field3 : bytestring & length=readuntil 0x2c;
field4 : bytestring & length=readuntil 0x2c;
field1 : bytestring &restofdata;

};

Does this feature exist in Bro?  I vaguely remember seeing a readuntil
feature for Bro, but can't pull up the exact info.

Thanks,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20181126/60b952ad/attachment.html 


More information about the Bro mailing list