set [ typewhere, as with tables, type]
You initialize sets listing their elements in braces:
global a = { 21/tcp, 23/tcp, 80/tcp, 443/tcp };which implicitly types a as a set[port] and then initializes it to contain the given 4 port values.
For multiple indices, you enclose each set of indices in brackets:
global b = { [21/tcp, "ftp"], [23/tcp, "telnet"], };which implicitly b as set[port, string] and then initializes it to contain the given two elements. (As with tables, the comma after the last element is optional.)
As with tables, you can group together sets of indices:
global c = { [21/tcp, "ftp"], [[80/tcp, 8000/tcp, 8080/tcp], "http"], };initializes c to contain 4 elements.
Also as with tables, you can use the &create_expire, &read_expire, and &write_expire attributes to control the automatic expiration of elements in a set. Deficiency: However, the &expire_func attribute is not currently supported.
You can test for whether a particular member is in a set using the in operator, as with tables. You add elements using the add statement:
add c[443/tcp, "https"];and can remove them using the delete statement:
add d[21/tcp, "ftp"];Also, as with tables, you can assign to the entire set, which assigns a shallow copy.
Finally, as with tables, you can loop over all of the indices in a set using the for statement.