Bro has native types for addresses and networks, making it much easier to work with network data. Today's Baby Bro script shows global variable definition, the use of the address and subnet types, and a simple conditional:
Running this from the CLI, we get the expected output:
jswan@so12a:~/bro$ bro addr_net_types.bro
126.96.36.199 is in network 188.8.131.52/16
Bro also has several interesting built-in functions for working with network data that we'll explore in upcoming posts. For now, we'll take a look at the mask_addr function, which allows you to use Bro as an improvised subnet calculator. You can run a Bro micro-script from the CLI with with the -e option, just like the -e flag in Perl or the -c flag in Python:
jswan@so12a:~/bro$ bro -e "print mask_addr(10.18.32.199,14);"
jswan@so12a:~/bro$ bro -e "print mask_addr(10.18.32.199,31);"
Great for those late-night subnetting sessions after too many microbrews!
Just in case you were wondering: all of this works natively for IPv6, with some changes to the syntax:
jswan@so12a:~/bro$ bro -e "print [fe80::1db9] in [fe80::]/64;"
T # T is the way Bro outputs "True" in a Boolean test
We'll look at some more IPv6 stuff in an upcoming post.