# net specification in bro

**URL:** <https://community.zeek.org/t/net-specification-in-bro/111>\
**Category:** Zeek\
**Created:** [November 16, 2000, 8:56am UTC](https://community.zeek.org/t/net-specification-in-bro/111 "2000-11-16T08:56:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [November 16, 2000, 8:56am UTC](https://community.zeek.org/t/net-specification-in-bro/111/1 "2000-11-16T08:56:21Z")

</div>

> I downloaded and installed bro 0.6 without problems, apart from some  
> minor changes required in Makefile.in and Rlogin.h.

(These are fixed for 0.7, by the way.)

> I noticed, however, that this version of bro still validates values  
> of type 'net' according to the outdated 'class A/B/C/D' convention.

Yes, sorry about that. This isn't fixed for 0.7, either (since the sites  
at which I run Bro don't happen to need this, and I'm short of cycles),  
except there are some uses of mask\_addr() that let you use /24's for  
particular networks that Bro looks at. You can get a pre-release snapshot  
from:

&nbsp;&nbsp;ftp://ftp.ee.lbl.gov/.vp-bro-pub-0.7a48.tar.gz

by the way.

The general solution requires adding CIDR prefixes to Bro, which is tricky  
because they have to work efficiently when used as table/set indices.  
It's that difficulty that's made it expensive for me to add this, absent  
a need to do so in my daytime job.

> In addition, I'd like to know whether bro developers have planned  
> to extend bro language with a type 'interval of IP addresses'.

I hadn't considered this - do you need something different from what you  
could achieve if Bro supported /n prefixes?

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![Antonella\_Giani](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@Antonella\_Giani](https://community.zeek.org/u/Antonella_Giani)\
**Post date:** [November 17, 2000, 9:18am UTC](https://community.zeek.org/t/net-specification-in-bro/111/2 "2000-11-17T09:18:18Z")

</div>

> Yes, sorry about that. This isn't fixed for 0.7, either  
> [...]  
> The general solution requires adding CIDR prefixes to Bro, which is  
> tricky because they have to work efficiently when used as table/set  
> indices.

We are planning to fix it, because we are quite interested in Bro and we  
are going to use it a lot. I'll post any result to this list, so if you are  
interested you can consider including it into future versions.

> \> In addition, I'd like to know whether bro developers have planned  
> \> to extend bro language with a type 'interval of IP addresses'.
> 
> I hadn't considered this - do you need something different from what you  
> could achieve if Bro supported /n prefixes?

Yes, I mean something more general: a way to specify IP ranges that cannot  
be specified through net masks such as /n, e.g. 192.168.34.12-23

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Antonella

&nbsp;&nbsp;Antonella Giani  
&nbsp;&nbsp;Dipartimento di Informatica - Corso Italia 40, 56125 Pisa (Italy)  
&nbsp;&nbsp;Tel: +39-050-887228 Fax: +39-050-887226  
&nbsp;&nbsp;web: [http://www.di.unipi.it/~giani/giani.html](http://www.di.unipi.it/~giani/giani.html)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/net-specification-in-bro/111/3 "2022-05-06T15:36:13Z")

</div>


