Error SSL::Info server_name - not present

Zeek
1

Hello,

I am a student, and I started few days ago to approach the bro's
scripting language.

I am writing a script that needs to get some information regarding SSL
communications. In my script I do:
- local server_n = c$ssl$server_name;
- local subj = c$ssl$subject;
Of course these fields are not always in the table (e.g. in SSLv3
server_name does not exist, therefore no values), then my script raise a
warning while it runs, saying that those values do not exist.

What can I do to avoid that warning output?

I have tried to do some checks like:

if (c$ssl$server_name=="-" || c$ssl$server_name=="empty")
  do something ...

But it does not work, I do not know how it is represented it is not in
the table.

thank you in advance,

glad to join this community,

R.

2

Hello Riccardo,

to check if a record entry is present, you can use the ?$ operator.

So - if ( c$ssl?$server_name)
do something…

Johanna