在以下规则中,将对通过给定条件的所有子对象执行then部分中的逻辑,我想在逻辑之后中断循环 在then-part只执行一次,怎么做
rule "test"
when
Parent( $childList : childList != null, childList.empty == false)
Child('testing'.equalsIgnoreCase(attribute)) from $childList
then
// testLogic
end
答案 0 :(得分:0)
如果在colarray = Application.Transpose(mytable.ListColumns("C1").DataBodyRange.rows(1).Text)
中不需要引用colarray = Application.Transpose(mytable.ListColumns("C1").DataBodyRange.Rows("1:6").Text)
对象(或其任何属性),则可以使用/* Add your own pcap file path in a fname string.
* To comile : gcc trace_reader.c -lpcap
*/
#include <stdio.h>
#include <pcap/pcap.h>
#include <net/ethernet.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <sys/time.h>
char errbuf[PCAP_ERRBUF_SIZE];
char *fname = "path/to/pcap_file";
uint8_t eth_src[ETH_ALEN];
uint8_t eth_dst[ETH_ALEN];
char ip4_src[INET_ADDRSTRLEN];
char ip4_dst[INET_ADDRSTRLEN];
int src_port;
int dst_port;
int priority;
//FILE *fp;
void callback(u_char *user, const struct pcap_pkthdr *h, const u_char *packet);
int main(void)
{
char ch;
int i, ret;
//fp = fopen("trace.txt", "w");
pcap_t *p;
p = pcap_open_offline(fname, errbuf);
if(p == NULL) {
printf("Unable to open pcap file!\n");
return 1;
}
if(pcap_loop(p, 10, callback, NULL) < 0) {
printf("pcap_loop() failed!\n");
return 1;
}
printf("Capture %d packets.\n", priority);
return 0;
}
void callback(u_char *user, const struct pcap_pkthdr *h, const u_char *packet) {
priority++;
const struct ether_header *ethernet;
const struct ip *ip;
const struct tcphdr *tcp;
const char *payload;
//uint32_t usec = h->caplen;
//uint32_t len = h->len;
//printf("%u %u\n", usec, len);
//printf("%lu %lu %lu\n", sizeof(struct ether_header), sizeof(struct ip), sizeof(struct tcphdr));
ethernet = (struct ether_header *)packet;
unsigned short ethernet_type = ntohs(ethernet->ether_type);
/* Extract IP information. */
ip = (struct ip*)(packet + sizeof(struct ether_header));
inet_ntop(AF_INET, &(ip->ip_src), ip4_src, INET_ADDRSTRLEN);
inet_ntop(AF_INET, &(ip->ip_dst), ip4_dst, INET_ADDRSTRLEN);
/* Extract TCP information. */
tcp = (struct tcphdr*)(packet + sizeof(struct ether_header) + sizeof(struct ip));
src_port = ntohs(tcp->source);
dst_port = ntohs(tcp->dest);
payload = (unsigned char *)(packet + sizeof(struct ether_header) + sizeof(struct ip) + sizeof(struct tcphdr));
printf("%hu %s %s %d %d %s\n", ethernet_type, ip4_src, ip4_dst, src_port, dst_port, payload);
}
运算符:
Child
如果出于某些原因确实需要RHS
对象或其任何属性,则可以执行以下操作(尽管不是很好):
exists
希望有帮助,
答案 1 :(得分:-1)
应该通过确定是自循环还是复循环来了解无限循环的原因。
您可以在规则名称旁边使用“ no-loop”作为“ no-loop true”
您还可以通过使用议程组,检查条件或标记来进行限制。这取决于您的复杂程度。