error when defining an enumerated data type

Zeek
1

Bro has an enumerated type for layer 3 protocols: enum { tcp, udp, icmp, unknown }. I want to create a variable with this type, but haven’t found the label in the documentation. Where do I find such information? I tried defining my own enumerated data type, but that generates the error ”identifier or enumerator value in enumerated type definition already exists”.

Best Regards,

Earl Eiland,

Sr. Cyber Security Engineer,

Emerging Technologies, root9B,

San Antonio, Texas

This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity named. If you are not the named addressee you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. Please notify the sender immediately by email if you received this email in error and delete this email from your system. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of root9B LLC.​

2

There is some reference documentation here:
https://www.bro.org/sphinx/script-reference/index.html

3

I looked at that. It covers enumerated data types in general, and the port type. The port type includes both the port # and protocol. It also covers how to extract the protocol from the port type with the function get_port_transport_proto. However, there's nothing on the protocol type's label.

4

In the reference documentation for type "port", it mentions you can
use function "get_port_transport_proto" to obtain the protocol type of
a port. If you look at the reference documentation for that function,
you can see it returns something of type "transport_proto".
If you look at the reference documentation for type "transport_proto",
you can see it's the enum type that you mentioned.

Now that you know the type, you can declare a local variable like this:

event bro_init()
{
   local x: transport_proto = tcp;
   print x;
}