There are two forms of port
constants. The first consists of an unsigned integer followed by either
“/tcp
” or “/udp
.” So, for example, “80/tcp
”
corresponds to TCP port 80 (the HTTP protocol used by the World Wide Web).
The second form of constant is specified using a predefined identifier,
such as “http
”, equivalent to “80/tcp
.” These predefined
identifiers are simply const
variables defined in the Bro
initialization file (see XXX), such as:
const http = 80/tcp;