The port type corresponds to a TCP or UDP port number. TCP and UDP ports are distinct. Thus, a value of type port can hold either a TCP or a UDP port, but at any given time it is holding exactly one of these.
There are two forms of port
constants. The first consists of an unsigned integer followed by either
``/tcp'' or ``/udp.'' So, for example, ``80/tcp''
corresponds to TCP port 80 (the HTTP protocol used by the World Wide Web).
The second form of constant is specified using a predefined identifier,
such as ``http'', equivalent to ``80/tcp.'' These predefined
identifiers are simply const variables defined in the Bro
initialization file (§
const http = 80/tcp;
The only operations that can be applied to port values are relationals. You may compare them for equality, and also for ordering. For example,
20/tcp < telnetyields true because telnet is a predefined constant set to 23/tcp.
UDP ports are considered larger than TCP ports, i.e., ``0/udp'' is larger than ``65535/tcp''.