using lookup_hostname()

Zeek
1

I am having issues implementing the new lookup_hostname() bif. The
problem involves the necessity for a boolean test while getting the
results from an addr_set.

Does anybody have a working example of this?

thanks,

scott

2

I'm not sure I understand the question but I've been using this in
an older script:

   when ( local h = lookup_addr(c$id$resp_h) )
        { ... }

Robin

3

Oops, copied the wrong snippet. I've also been using this:

      when ( local addresses = lookup_hostname(pu$host) )
           {
           for ( a in addresses )
               [...]
           }

Robin