Next: Net Type Up: Values, Types, and Constants Previous: Port Type Contents Index
Subsections

- Address Constants
- Address Operators

#
Address Type

Another networking type provided by Bro is `addr`, corresponding to an IP address. The only operations that can be performed on them are comparisons for equality or inequality (also, a built-in function provides masking, as discussed below).

When configuring the Bro distribution, if you specify `-enable-brov6` then Bro will be built to support both IPv4 and IPv6 addresses, and an `addr` can hold either. Otherwise, addresses are restricted to IPv4.

##
Address Constants

Constants of type `addr` have the familiar ``dotted quad'' format, , where the all lie between 0 and 255. If you have configured for IPv6 support as discussed above, then you can also use the colon-separated hexadecimal form described in [RFC2373].

Often more useful are hostname constants. There is no Bro type corresponding to Internet hostnames. Because hostnames can correspond to multiple IP addresses, you quickly run into ambiguities if comparing one hostname with another. Bro does, however, support hostnames as constants. Any series of two or more identifiers delimited by dots forms a hostname constant, so, for example, ```lbl.gov`'' and ```www.microsoft.com`'' are both hostname constants (the latter, as of this writing, corresponds to 5 distinct IP addresses). The value of a hostname constant is a `list` of `addr` containing one or more elements. These lists (as with the lists associated with certain `port` constants, discussed above) cannot be used in Bro expressions; but they play a central role in initializing Bro `table`'s and `set`'s.

##
Address Operators

The only operations that can be applied to `addr` values are comparisons for equality or inequality, using `==` and `!=`. However, you can also operate on `addr` values using `mask_addr` to mask off lower address bits, and `to_net` to convert an `addr` to a `net` (see below).

Next: Net Type Up: Values, Types, and Constants Previous: Port Type Contents Index