I have: global destinations: set[addr,port];
The port data type will store port information in the following format:
443/tcp, 22/tcp, 53/udp, etc.
However, I'm only interested in the port number, not the protocol. How do
I get the port number only?
you should be able to split the string into an array and use the part you want only.
local dst_port_proto = c$id$resp_p;
local port_pair = split(dst_port_proto, ///);
taking the connection destination port/proto pairing and spliting it into an array with the split occuring on the “/”
local port_num = port_pair;
local port_proto = port_pair;
This gives you the port as a string: