If Statement Syntax

Zeek
1

Hi,

I’m trying to find out what is in the variable c$id$resp_p (which is a port number). I tried using the following syntax
if ( c$id$resp_p == “443” ) {
…
}

On 443 I try it with and without quotations around it but I always get the following error:
line 293 (c$id$resp_p == 443): error, type clash in comparison
Does anyone know the proper syntax?

Also what is the proper syntax for else if in Bro? Is it else if () or elsif ()?
Thanks.

Daniel.

2

line 293 (c$id$resp_p == 443): error, type clash in comparison
Does anyone know the proper syntax?

Port constants are <number>/<transport>, so you need 443/tcp if you mean
a TCP port.

Also what is the proper syntax for else if in Bro? Is it else if () or elsif
()?

These sorts of questions are easy to investigate by looking in the
scripts provided in bro/policy/*.bro.

    Vern

3

if ( c$id$resp_p == "443" ) {

Bro has a dedicated port type. Try c$id$resp_p == 443/tcp .

Also what is the proper syntax for else if in Bro? Is it else if () or elsif

else if.

Robin