table of record type

Zeek
1

type host_type: record {
bytes: int;
stime: time;
};

type hostTable: table[addr] of host_type;

global hosts: hostTable;

I’ve create the above structure, but I haven’t a clue on the syntax to dynamically populate it. I’ve tried the below with no success.

hosts[c$id$orig_h] = [[$bytes=0, $stime=network_time()]];

Thank you,

Brian

2

Hi,

you can populate the table by using…

hosts[c$id$orig_h] = [$bytes=+0, $stime=network_time()];

You used one set of to many (the table contains a plain record). Furthermore,
positive numbers are counts by default - if you specify them explicitly you have
to prefix them with + to tell Bro to use an integer type instead.

Johanna