When you define a variable, you can explicitly type it by specifying its type after a colon. For example,
global a: count;
directly indicates that a's type is count
.
However, Bro can also implicitly type the variable by looking at the type of the expression you use to initialize the variable:
global a = 5;
also declares a's type to be count
, since that's
the type of the initialization expression (the constant 5).
There is no difference between this declaration and:
global a: count = 5;
except that it is more concise both to write and to read. In particular, Bro remains strongly typed, even though it also supports implicit typing; the key is that once the type is implicitly inferred, it is thereafter strongly enforced.
Bro's type inference is fairly powerful: it can generally figure out the type whatever initialization expression you use. For example, it correctly infers that:
global c = { [21/tcp, "ftp"], [[80/tcp, 8000/tcp, 8080/tcp], "http"], };
specifies that c's type is set[port, string]. But for still more complicated expressions, it is not always able to infer the correct type. When this occurs, you need to explicitly specify the type.