howto: getting the port number only

Zeek
1

Hi all,

I have: global destinations: set[addr,port];

The port data type will store port information in the following format:

443/tcp, 22/tcp, 53/udp, etc.

However, I'm only interested in the port number, not the protocol. How do
I get the port number only?

--mel

2

Mel,
you should be able to split the string into an array and use the part you want only.

Ex.
local dst_port_proto = c$id$resp_p;
local port_pair = split(dst_port_proto, ///);

taking the connection destination port/proto pairing and spliting it into an array with the split occuring on the “/”

local port_num = port_pair[1];
local port_proto = port_pair[2];

Jake

3

This gives you the port as a string:

     fmt("%d", 42/tcp)

Robin