next up previous contents index
Next: Net Type Up: Values, Types, and Constants Previous: Port Type   Contents   Index

Subsections


Address Type

Another networking type provided by Bro is addr, corresponding to an IP address. The only operations that can be performed on them are comparisons for equality or inequality (also, a built-in function provides masking, as discussed below).

When configuring the Bro distribution, if you specify -enable-brov6 then Bro will be built to support both IPv4 and IPv6 addresses, and an addr can hold either. Otherwise, addresses are restricted to IPv4.


Address Constants

Constants of type addr have the familiar ``dotted quad'' format, $A\_1 {\tt .} A\_2 {\tt .} A\_3 {\tt .} A\_4$, where the $A\_i$ all lie between 0 and 255. If you have configured for IPv6 support as discussed above, then you can also use the colon-separated hexadecimal form described in [RFC2373].

Often more useful are hostname constants. There is no Bro type corresponding to Internet hostnames. Because hostnames can correspond to multiple IP addresses, you quickly run into ambiguities if comparing one hostname with another. Bro does, however, support hostnames as constants. Any series of two or more identifiers delimited by dots forms a hostname constant, so, for example, ``lbl.gov'' and ``www.microsoft.com'' are both hostname constants (the latter, as of this writing, corresponds to 5 distinct IP addresses). The value of a hostname constant is a list of addr containing one or more elements. These lists (as with the lists associated with certain port constants, discussed above) cannot be used in Bro expressions; but they play a central role in initializing Bro table's and set's.


Address Operators

The only operations that can be applied to addr values are comparisons for equality or inequality, using == and !=. However, you can also operate on addr values using mask_addr to mask off lower address bits, and to_net to convert an addr to a net (see below).


next up previous contents index
Next: Net Type Up: Values, Types, and Constants Previous: Port Type   Contents   Index
Vern Paxson 2004-03-21