Constants of type addr
have the familiar “dotted quad” format,
A_1.A_2.A_3.A_4
, where the A_i all lie
between 0 and 255. If you have configured for IPv6 support as discussed
above, then you can also use the colon-separated hexadecimal form
described in RFC2373.
Often more useful are hostname constants. There is no Bro
type corresponding to Internet hostnames. Because hostnames can correspond
to multiple IP addresses, you quickly run into ambiguities if comparing
one hostname with another. Bro does, however, support hostnames as
constants. Any series of two or more identifiers delimited by dots
forms a hostname constant, so, for example, “lbl.gov
” and
“www.microsoft.com
” are both hostname constants (the latter,
as of this writing, corresponds to 5 distinct IP addresses). The value of
a hostname constant is a list
of addr
containing one
or more elements. These lists (as with the lists associated with
certain port
constants, discussed above) cannot be used in
Bro expressions; but they play a central role in initializing Bro
tables and sets.