# Attributes and Ports Questions **URL:** \ **Category:** Zeek\ **Created:** [October 29, 2014, 1:10am UTC](https://community.zeek.org/t/attributes-and-ports-questions/3335 "2014-10-29T01:10:46Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [October 29, 2014, 1:10am UTC](https://community.zeek.org/t/attributes-and-ports-questions/3335/1 "2014-10-29T01:10:46Z")
Hi All, Is anyone using the following attributes? How are you using them? I believe some of these have been deprecated. &rotate\_interval &rotate\_size &mergeable &synchronize (I think there was a post earlier last month about this one) &persistent &group &add\_func &delete\_func &encrypt (applying this to a file causes Bro to "elegantly terminate" for me) bro -Ci eth0 -e 'global f1: file = open("f.out") &encrypt' What is the purpose of the unknown port type? And why do they only range from 0-255? Compare the results of the following commands. bro -e 'print 0/unknown; print 255/unknown;' bro -e 'print 0/unknown; print 255/unknown; print 256/unknown;' How are ports flattened? See the results of the following command. bro -e 'print 0/udp; print |0/udp|; print |32/tcp|; print |11/tcp|; print |132/unknown|; print 132/unknown;' Any insights are appreciated. -AK ---
**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\ **Post date:** [October 29, 2014, 7:35pm UTC](https://community.zeek.org/t/attributes-and-ports-questions/3335/2 "2014-10-29T19:35:23Z")
> What is the purpose of the unknown port type? It should mostly be used internally to signify an uninitialized/invalid transport protocol. I don’t think it’s common for that to actually be exposed to the scripting-layer for practical usage. > And why do they only > range from 0-255? Compare the results of the following commands. > bro -e 'print 0/unknown; print 255/unknown;' > bro -e 'print 0/unknown; print 255/unknown; print 256/unknown;’ Likely arbitrary and just due to copy-paste of the code that parses ICMP port literals (for ICMP, Bro uses 0-255 to correspond to the Type/Code values). > How are ports flattened? See the results of the following command. > bro -e 'print 0/udp; print |0/udp|; print |32/tcp|; print |11/tcp|; > print |132/unknown|; print 132/unknown;' Internally, a port is a single uint64 with some of the high-bits set to indicate which port-space it belongs to. You’re seeing that value here. E.g. bro \-e 'print |32/tcp| == 0x10000 \+ 32' T bro -e 'print |37/udp| == 0x20000 + 37’ T - Jon ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 30, 2014, 2:53pm UTC](https://community.zeek.org/t/attributes-and-ports-questions/3335/3 "2014-10-30T14:53:58Z")
Hi Anthony, have you seen this page? [https://www.bro.org/sphinx-git/script-reference/attributes.html](https://www.bro.org/sphinx-git/script-reference/attributes.html) It's pretty new (though maybe it's actually where your questiosns are coming from 🙂 To add a bit to that: > &rotate\_interval > &rotate\_size This used to be primary log rotation mechanism before we switched to the new logging system/format. I've been wondering if we should just remove these attributes. > &mergeable > &synchronize (I think there was a post earlier last month about this one) > &persistent These are going to go away, but we aren't there yet. We may start deprecating them with the next release, which is scheduled to ship with a first version of their replacement, the new Broker library. > &group A bit of an obscure feature, originally added to toggle selected sets of analysis dynamically from BroControl. Don't think that's used anywhere and I'm inclined to remove it. > &add\_func > &delete\_func These aren't used very often, but can be useful in individual cases. > &encrypt (applying this to a file causes Bro to "elegantly terminate" for me) > bro -Ci eth0 -e 'global f1: file = open("f.out") &encrypt' Another relict from old-style logging, although the new framework doesn't have any equivalent functionality yet. Mind filing a ticket for the crash? We should either fix it or remove the attribute. Robin ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [October 30, 2014, 3:40pm UTC](https://community.zeek.org/t/attributes-and-ports-questions/3335/4 "2014-10-30T15:40:02Z")
Thanks for the explanations, Jon. -AK ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [October 30, 2014, 3:44pm UTC](https://community.zeek.org/t/attributes-and-ports-questions/3335/5 "2014-10-30T15:44:00Z")
That page is exactly where my questions are coming from. I tried using each of the attributes in a few toy scripts and was wondering if people are using them in production as I could not find some of them used in base or policy. Thanks for the insight, Robin. -AK ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/attributes-and-ports-questions/3335/6 "2022-05-06T15:42:11Z")