Handling optional fields

Description

Optional fields in records are currently returned in a record with type BRO_TYPE_UNKNOWN. The Bro serialization protocol uses a NULL pointer instead. To streamline the two interfaces, it thus makes more sense to return a NULL pointer in

instead of an empty field instance.

Environment

None

Assignee

kreibich

Reporter

Matthias Vallentin

Labels

None

External issue ID

8

Components

Affects versions

Priority

Normal
Configure