Another networking type provided by Bro is addr, corresponding to an IP address. The only operations that can be performed on them are comparisons for equality or inequality (also, a built-in function provides masking, as discussed below).
When configuring the Bro distribution, if you specify -enable-brov6 then Bro will be built to support both IPv4 and IPv6 addresses, and an addr can hold either. Otherwise, addresses are restricted to IPv4.
Constants of type addr have the familiar ``dotted quad'' format,
, where the
all lie
between 0 and 255. If you have configured for IPv6 support as discussed
above, then you can also use the colon-separated hexadecimal form
described in [RFC2373].
Often more useful are hostname constants. There is no Bro type corresponding to Internet hostnames. Because hostnames can correspond to multiple IP addresses, you quickly run into ambiguities if comparing one hostname with another. Bro does, however, support hostnames as constants. Any series of two or more identifiers delimited by dots forms a hostname constant, so, for example, ``lbl.gov'' and ``www.microsoft.com'' are both hostname constants (the latter, as of this writing, corresponds to 5 distinct IP addresses). The value of a hostname constant is a list of addr containing one or more elements. These lists (as with the lists associated with certain port constants, discussed above) cannot be used in Bro expressions; but they play a central role in initializing Bro table's and set's.
The only operations that can be applied to addr values are
comparisons for equality or inequality, using ==
and !=
.
However, you can also operate on addr values using
mask_addr to mask off lower address bits, and to_net
to convert an addr to a net (see below).