Problem accessing additional Field in connection record

Zeek
1

Hi everybody,

I've got a problem accessing a custom added field in the connection record.
My version of Bro is 1.3.2.

In detail:
I added a new field called "flow_start" inside the connection record in
file bro.init. This variable is also added in file Conn.h and Conn.cc to
fill it with an appropriate value in the constructor
Connection::Connection. Additionally, I changed file conn.bro to output the
content of the variable in function "record_connection". I'm doing this, as
I want to record the time of the first packet of the flow belonging to the
connection.
When I start Bro with "conn.bro" as parameter now, it starts working,
outputs a first connection correctly including my new field, but at the
second call of "record_connection", Bro exits with the error

1212999573.377278 ./conn.bro, line 211 (c$flow_start): internal error:
field value missing

What am I doing wrong? It seems that my variable is correctly set the first
time, but afterwards it isn't? It is strange, as the variable should always
be set in Connection::Connection.

I attached the (rather short) diff of my changes.

Thanks in advance & bye,
Tobi

diff (2.67 KB)

2

Does it help to start Bro with "use_connection_compressor=F"? There
is another location inside the Compressor where connection records
are created (ConnCompressor::Event in ConnCompressor.cc).

Robin

3

Hi Robin,

it was the Compressor. Thanks a lot, it works now!

bye,
Tobi