There are two forms of port
constants. The first consists of an unsigned integer followed by one of
“/tcp
”, “/udp
”, “/icmp
”, or “/unknown
”.
So, for example, “80/tcp
” corresponds to TCP port 80 (typically
used for the HTTP protocol). The second form of constant is specified
using a predefined identifier, such as “http
”, equivalent to
“80/tcp
.” These predefined identifiers are simply const
variables defined in the Bro initialization file, such as:
const http = 80/tcp;