# port field in file input

**URL:** <https://community.zeek.org/t/port-field-in-file-input/3155>\
**Category:** Zeek\
**Created:** [June 18, 2014, 6:20pm UTC](https://community.zeek.org/t/port-field-in-file-input/3155 "2014-06-18T18:20:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_Wenthold](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@Michael\_Wenthold](https://community.zeek.org/u/Michael_Wenthold)\
**Post date:** [June 18, 2014, 6:20pm UTC](https://community.zeek.org/t/port-field-in-file-input/3155/1 "2014-06-18T18:20:59Z")

</div>

Is there anything that prevents me from loading data from a file with an idx type “port”?

I’m trying to put the data in a file:

#fields tgt\_port tgt\_subnet  
#types port subnet  
5222/tcp [74.127.0.0/24](http://74.127.0.0/24)

but when my script tries to load the file I get the following error:  
Input::READER\_ASCII: Number ‘5222/tcp’ contained non-numeric trailing characters. Ignored trailing characters ‘/tcp’

The file reader table idx types are all set to type “port”. I know I can just put all of the information in the script instead of offloading it to a file, but I don’t see anything that would prevent me from offloading the information to a file. I feel like I’m missing something really basic, but I’m definitely missing something.

---

<div class="post-metadata">

**Author:** ![Aashish\_Sharma1](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aashish\_Sharma1](https://community.zeek.org/u/Aashish_Sharma1)\
**Post date:** [June 18, 2014, 7:35pm UTC](https://community.zeek.org/t/port-field-in-file-input/3155/2 "2014-06-18T19:35:15Z")

</div>

You have to format the input file in this manner, eg:

#fields exclude\_ip exclude\_port t comment  
1.2.3.4 25 tcp mail

and define the input structs as :

type ipportexclude\_Idx: record {  
&nbsp;&nbsp;&nbsp;&nbsp;exclude\_ip: addr;  
&nbsp;&nbsp;&nbsp;&nbsp;exclude\_port: port &type\_column="t";  
};

type ipportexclude\_Val: record {  
&nbsp;&nbsp;&nbsp;&nbsp;exclude\_ip: addr;  
&nbsp;&nbsp;&nbsp;&nbsp;exclude\_port: port &type\_column="t" ;  
&nbsp;&nbsp;&nbsp;&nbsp;comment: string &optional ;  
} ;

Hope this helps,  
Aashish

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/port-field-in-file-input/3155/3 "2022-05-06T15:41:51Z")

</div>