Re: [Bro-Dev] Broccoli question
On Dec 19, 2013, at 6:09 PM, Siwek, Jonathan Luke wrote: > > On Dec 19, 2013, at 2:49 PM, Randy Caldejon wrote: > >> Can somebody tell me if BRO_TYPE_TABLE is supported at part of a record? > > Regardless of whether it’s part of a record, I don’t think broccoli can > create and send tables (as well as sets/vectors). You may have to send > individual key-value pairs and reconstruct the table on the Bro-side. > > - Jon Ok, that's the path that I'll take. Thanks for confirming. -- Randy ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] Broccoli question
Hi,
Can somebody tell me if BRO_TYPE_TABLE is supported at part of a record? More
specifically, I want to send records that look something like this to Bro using
Broccoli.
type example_record: record
{
uid:string;
hash: table [string] of string;
};
However, my implementation core dumps when the following is called (after
populating hashTable with key/value pairs):
BroTable *hashTable = bro_table_new();
.
.
.
bro_record_add_val(rec, "hash", BRO_TYPE_TABLE, NULL, hashTable);
.
.
bro_event_add_val(ev, BRO_TYPE_RECORD, NULL, rec);
I could not find any examples in the docs or test library on how to include a
table as a field in a record.
Thanks,
Randy
___
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
Re: [Bro-Dev] Broccoli and vectors
Thanks. I'll try that. --Randy > On Dec 5, 2013, at 13:11, "Siwek, Jonathan Luke" wrote: > > >> On Dec 5, 2013, at 11:54 AM, Randy Caldejon wrote: >> >> I'm implementing an application that sends DNS::Info records via Broccoli to >> Bro. However, it appears that Broccoli does not fully support vectors. Is >> this correct? If it does, can somebody point me to an example on how to >> populate a vector using the Broccoli C API. I searched through the Broccoli >> docs but could not find anything. > > You’re right, Broccoli does not support sending vectors (though I added > support for recv’ing them earlier this week). > > A possible workaround for sending vectors via Broccoli may be to send each > element individually in an event and have Bro construct the vector on the > other side one element at a time. > > - Jon ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
Re: [Bro-Dev] Broccoli and vectors
Ok, thanks for the quick response. --Randy > On Dec 5, 2013, at 12:58, Robin Sommer wrote: > > Half of the support for vectors is there since yesterday: > > > https://github.com/bro/broccoli/commit/756a8a733b1f03b94afcbb93807813a89b3cfb89 > > However it sounds like you need the opposite: there's no support yet > for producing events with vectors. > > Robin > >> On Thu, Dec 05, 2013 at 12:54 -0500, you wrote: >> >> Hi, >> >> I'm implementing an application that sends DNS::Info records via >> Broccoli to Bro. However, it appears that Broccoli does not fully >> support vectors. Is this correct? If it does, can somebody point me >> to an example on how to populate a vector using the Broccoli C API. I >> searched through the Broccoli docs but could not find anything. >> >> Thanks, >> >> -- Randy >> >> >> >> >> >> >> >> >> >> >> ___ >> bro-dev mailing list >> bro-dev@bro.org >> http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev > > > -- > Robin Sommer * Phone +1 (510) 722-6541 * ro...@icir.org > ICSI/LBNL* Fax +1 (510) 666-2956 * www.icir.org/robin ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] Broccoli and vectors
Hi, I'm implementing an application that sends DNS::Info records via Broccoli to Bro. However, it appears that Broccoli does not fully support vectors. Is this correct? If it does, can somebody point me to an example on how to populate a vector using the Broccoli C API. I searched through the Broccoli docs but could not find anything. Thanks, -- Randy ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
