Jan,
> I guess the function for initialization receives the index that should
> be initialized.
Thank you. This works!
For future reference:
I also needed to convert the following table to use opaque of cardinality for
this table grows reasonably big:
global distinct_backscatter_peers: table[addr] of table[port] of set[addr]
&read_expire=1 day;
Here is how I did this one:
type bs: table[port] of opaque of cardinality &default=function(p:port): opaque
of cardinality {return hll_cardinality_init(0.1, 0.95); };
global c_distinct_backscatter_peers: table[addr] of bs &read_expire=1 day ;
and to access:
if ( orig !in c_distinct_backscatter_peers)
c_distinct_backscatter_peers[orig] = table() ;
if (s_port !in c_distinct_backscatter_peers[orig])
{
local cp: opaque of cardinality = hll_cardinality_init(0.1,
0.95);
c_distinct_backscatter_peers[orig][s_port]=cp ;
}
hll_cardinality_add(c_distinct_backscatter_peers[orig][s_port], resp);
local d_val =
double_to_count(hll_cardinality_estimate(c_distinct_backscatter_peers[orig][s_port]));
### use d_val here ....
Now may be there is a better more elegant way to do this, but above seems to
work for me.
Again, thanks Jan!!
Aashish
On Thu, May 12, 2016 at 04:36:36PM +0200, Jan Grashöfer wrote:
> > how do I declare (3) so that I can avoid the "&default function type clash"
> > error above.
>
> I guess the function for initialization receives the index that should
> be initialized. In this case the index consists of two values. I tried
> the following and Bro did not complain:
>
> global c_likely_scanner: table[addr,port] of opaque of cardinality
> &default = function(a: addr, p: port): opaque of cardinality {
> return hll_cardinality_init(0.1, 0.95); }
> &read_expire=1 day;
>
> Hope that works for you!
>
> Regards,
> Jan
> _______________________________________________
> bro-dev mailing list
> bro-dev@bro.org
> http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
_______________________________________________
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
