There are 18 (XXX check this) types of values in the Bro type system:
bool
for Booleans;
count
, int
, and double
types, collectively
called numeric, for arithmetic and logical operations, and comparisons;
enum
for enumerated types similar to those in C;
string
, character strings that can be used
for comparisons and to index tables and sets;
pattern
, regular expressions that can be used for pattern
matching;
time
and interval
, for absolute and relative times,
collectively termed temporal;
port
, a TCP or UDP port number;
addr
, an IP address;
net
, a network prefix;
record
, a collection of values (of possibly different types),
each of which has a name;
table
, an associative array, indexed by tuples of
scalars and yielding values of a particular type;
set
, a collection of tuples-of-scalars, for which a
particular tuple's membership can be tested;
file
, a disk file to write or append to;
function
, a function that when called with a list of
values (arguments) returns a value;
event
, an event handler that is invoked with a list of
values (arguments) any time an event occurs.
Every value in a Bro script has one of these types.
For most types there are ways of specifying constants representing
values of the type. For example, 2.71828
is a constant
of type double
, and 80/tcp
is a constant of type
port
. The discussion of types in
XXX below includes a description
of how to specify constants for the types.
Finally, even though Bro variables have static types, meaning that their type is fixed, often their type is inferred from the value to which they are initially assigned when the variable is declared. For example,
local a = "hi there";
fixes a
's type as string
, and
local b = 6;
sets b
's type to count
. See
for further discussion.