Bro - Broccoli Data Type Mismatch issue


I am developing Bro scripts for reading modbus packets.
I send the packet details to broccoli as events.
When I send an event with parameters of type “addr” and “vector of count” from the bro script to broccoli, the broccoli doesn’t receive the parameters correctly.
The code –

Bro script –

global pong: event(reg: vector of count, ipaddr: addr);

event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)

event pong(ModbusRegisters,c$id$resp_h);

#ModbusRegisters - type vector of count
#c$id$resp_h type-addr


Broccoli Script –

static void bro_pong(BroConn *conn,void *data,BroRecord *rec,BroAddr *address)

int type = BRO_TYPE_COUNT;
uint64 *register;
if (! (seq = bro_record_get_nth_val(rec, 0, &type)))
printf(“Error getting sequence count from event, got type %i\n”, type);
printf("pong event from seq=%“PRIu64"”,*register);



Thanks in advance!

Vishak Muthukumar
Graduate Student
University of California, Davis 

You are passing the type, you need to pass the value.

event pong(headers, c$id$resp_h);


global pong: event(reg: vector of count, ipaddr: addr);


static void bro_pong(BroConn *conn,void *data,BroRecord *rec,BroAddr *address)

I'm not completely sure that Vectors are supported as values in broccoli. From my quick glance it looks like they're an unsupported but you can't just treat them like a record like you are doing. There may be other problems, but I noticed that immediately. You also aren't showing us any code where you are subscribing to events with broccoli so I can't even be sure you are doing that correctly.


The issue is solved,
I needed to do typecasting to receive the correct IP address -

The broccoli script is –

static void bro_pong(BroConn *conn,void *data,BroAddr *address)

char addr[INET6_ADDRSTRLEN];
inet_ntop(AF_INET, address->addr + 3, addr, INET6_ADDRSTRLEN);
printf(“Received bro_address%s\n”, addr);

Thanks for your help.