TQ
2018-11-26 22:34:20 UTC
Hello There,
I have some data that is delimited by a comma, but the data length could
vary in between. For example:
1) A,B,C,D,E
2) AA,BBB,C,DDDDD,EE
3) AAA,BB,CCCCCCCC,DD,EEE
I was thinking of using bytestring inside the record and have it read until
each delimiter... something like...
type My_Data = record {
field1 : bytestring & length=readuntil 0x2c;
field2 : bytestring & length=readuntil 0x2c;
field3 : bytestring & length=readuntil 0x2c;
field4 : bytestring & length=readuntil 0x2c;
field1 : bytestring &restofdata;
};
Does this feature exist in Bro? I vaguely remember seeing a readuntil
feature for Bro, but can't pull up the exact info.
Thanks,
I have some data that is delimited by a comma, but the data length could
vary in between. For example:
1) A,B,C,D,E
2) AA,BBB,C,DDDDD,EE
3) AAA,BB,CCCCCCCC,DD,EEE
I was thinking of using bytestring inside the record and have it read until
each delimiter... something like...
type My_Data = record {
field1 : bytestring & length=readuntil 0x2c;
field2 : bytestring & length=readuntil 0x2c;
field3 : bytestring & length=readuntil 0x2c;
field4 : bytestring & length=readuntil 0x2c;
field1 : bytestring &restofdata;
};
Does this feature exist in Bro? I vaguely remember seeing a readuntil
feature for Bro, but can't pull up the exact info.
Thanks,