# Bro - Broccoli Data Type Mismatch issue

**URL:** <https://community.zeek.org/t/bro-broccoli-data-type-mismatch-issue/2851>\
**Category:** Zeek\
**Created:** [October 5, 2013, 11:20pm UTC](https://community.zeek.org/t/bro-broccoli-data-type-mismatch-issue/2851 "2013-10-05T23:20:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vishak\_Muthukumar](https://avatars.discourse-cdn.com/v4/letter/v/f14d63/32.png) [@Vishak\_Muthukumar](https://community.zeek.org/u/Vishak_Muthukumar)\
**Post date:** [October 5, 2013, 11:20pm UTC](https://community.zeek.org/t/bro-broccoli-data-type-mismatch-issue/2851/1 "2013-10-05T23:20:40Z")

</div>

Hi,

I am developing Bro scripts for reading modbus packets.  
I send the packet details to broccoli as events.  
When I send an event with parameters of type “addr” and “vector of count” from the bro script to broccoli, the broccoli doesn’t receive the parameters correctly.  
The code –

Bro script –

global pong: event(reg: vector of count, ipaddr: addr);

event modbus\_read\_holding\_registers\_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)  
{

event pong(ModbusRegisters,c$id$resp\_h);

#ModbusRegisters - type vector of count  
#c$id$resp\_h type-addr

}

Broccoli Script –

static void bro\_pong(BroConn \*conn,void \*data,BroRecord \*rec,BroAddr \*address)  
{

int type = BRO\_TYPE\_COUNT;  
uint64 \*register;  
if (! (seq = bro\_record\_get\_nth\_val(rec, 0, &type)))  
{  
printf(“Error getting sequence count from event, got type %i\n”, type);  
return;  
}  
printf("pong event from seq=%“PRIu64"”,\*register);

printf("\nAddress:");  
for(i=3;i\>=0;i–)  
{  
printf("%“PRIu32”.",address-\>addr[i]);  
}  
printf("\n");

}

Thanks in advance!

```auto
Vishak Muthukumar

```

```auto
Graduate Student

```

```auto
University of California, Davis 

```

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [October 7, 2013, 12:35pm UTC](https://community.zeek.org/t/bro-broccoli-data-type-mismatch-issue/2851/2 "2013-10-07T12:35:21Z")

</div>

You are passing the type, you need to pass the value.

event pong(headers, c$id$resp\_h);

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [October 9, 2013, 4:50pm UTC](https://community.zeek.org/t/bro-broccoli-data-type-mismatch-issue/2851/3 "2013-10-09T16:50:14Z")

</div>

> global pong: event(reg: vector of count, ipaddr: addr);

\<snip\>

> static void bro\_pong(BroConn \*conn,void \*data,BroRecord \*rec,BroAddr \*address)

I'm not completely sure that Vectors are supported as values in broccoli. From my quick glance it looks like they're an unsupported but you can't just treat them like a record like you are doing. There may be other problems, but I noticed that immediately. You also aren't showing us any code where you are subscribing to events with broccoli so I can't even be sure you are doing that correctly.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![Vishak\_Muthukumar](https://avatars.discourse-cdn.com/v4/letter/v/f14d63/32.png) [@Vishak\_Muthukumar](https://community.zeek.org/u/Vishak_Muthukumar)\
**Post date:** [October 10, 2013, 5:20pm UTC](https://community.zeek.org/t/bro-broccoli-data-type-mismatch-issue/2851/4 "2013-10-10T17:20:02Z")

</div>

The issue is solved,  
I needed to do typecasting to receive the correct IP address -

The broccoli script is –

static void bro\_pong(BroConn \*conn,void \*data,BroAddr \*address)  
{

char addr[INET6\_ADDRSTRLEN];  
inet\_ntop(AF\_INET, address-\>addr + 3, addr, INET6\_ADDRSTRLEN);  
printf(“Received bro\_address%s\n”, addr);  
}

Thanks for your help.

Vishak

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/bro-broccoli-data-type-mismatch-issue/2851/5 "2022-05-06T15:41:17Z")

</div>