Re: pkg add-interfaces

Jan Grashöfer <[email protected]> Mon, 9 Dec 2019 18:38:35 +0100
Newsgroups gmane.comp.security.detection.bro
Message-ID <[email protected]>
Hi Scot,

unfortunately I cannot reproduce the issue.

> Looking at the code for the function interface_ext_func looks like the =

> condition is most likely failing and there is no return value specified.
> =

> function interface_ext_func(path: string): AddedFields
> =

>  =A0=A0=A0=A0=A0=A0=A0 {
> =

>  =A0=A0=A0=A0=A0=A0=A0 if ( Cluster::nodes[Cluster::node]?$interface )
> =

>  =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 return AddedFields($interf=
ace =3D =

> Cluster::nodes[Cluster::node]$interface);
> =

>  =A0=A0=A0=A0=A0=A0=A0 }

You might try to add something like the following to deal with timing =

issues:

else
   return AddedFields($interface =3D fmt("%s:unknown-interface", =

Cluster::node));

However, if the interfaces do not appear in the logs after an initial =

warm-up, there might be something else wrong.

Jan
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek