3.8.1 Port Constants

There are two forms of port constants. The first consists of an unsigned integer followed by either “/tcp” or “/udp.” So, for example, “80/tcp” corresponds to TCP port 80 (the HTTP protocol used by the World Wide Web). The second form of constant is specified using a predefined identifier, such as “http”, equivalent to “80/tcp.” These predefined identifiers are simply const variables defined in the Bro initialization file, such as:

         const http = 80/tcp;