# bif example **URL:** \ **Category:** Zeek\ **Created:** [January 5, 2017, 4:40am UTC](https://community.zeek.org/t/bif-example/4576 "2017-01-05T04:40:52Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Dk\_Jack](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@Dk\_Jack](https://community.zeek.org/u/Dk_Jack)\ **Post date:** [January 5, 2017, 4:40am UTC](https://community.zeek.org/t/bif-example/4576/1 "2017-01-05T04:40:52Z")
Hi, I have a question about [BIF example](https://www.bro.org/development/howtos/bif-doc/example.html). I am trying to write my own BIF functions. I’d like to store some data (i.e. pass in a record to a BIF function) and retrieve it later as a record when I am processing traffic. In the example, I see ‘foobar’ record is defined in bro.init. There is a declaration of foobar record in types.bif. This is being accessed in bro.bif. How is the ‘foobar’ record type resolved when it’s referenced in bro.bif? Is the example complete or is it missing some includes and such? I tried to the same but my bro script fails because my bif file doesn’t know about my record type. I included my ‘types.bif.h’ in my bif file get it compiled without errors. But it fails to load because it does not know about my record type. I get the error ‘identifier not defined:’. Any help is appreciated. Thanks. Dk. ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [January 19, 2017, 12:34am UTC](https://community.zeek.org/t/bif-example/4576/2 "2017-01-19T00:34:46Z")
Hi, > I have a question about BIF example > \<[https://www.bro.org/development/howtos/bif-doc/example.html>\](https://www.bro.org/development/howtos/bif-doc/example.html>%5C). I am trying > to write my own BIF functions. I'd like to store some data (i.e. pass in a > record to a BIF function) and retrieve it later as a record when I am > processing traffic. I am not quite sure that I understand - do you want the bif to store data that can be accessed later by the same (or a different) bif? I am not sure if I know of anyone doing that - it is more common for a bif to return data, that the user then can store somewhere in scriptland (e.g. in the connection record). > In the example, I see 'foobar' record is defined in bro.init. There is a > declaration of foobar record in types.bif. This is being accessed in > bro.bif. How is the 'foobar' record type resolved when it's referenced > in bro.bif? Is the example complete or is it missing some includes and > such? The example is a bit out of date here as bro.init does not exist anymore. I assume the best way to see how something like this works is to look at the bifs that are added by one of the individual protocol or file analyzers, since they are smaller, all necessary files are contained in a directory, and they work very similar to how you would add bifs in a package that you create. That being said, the general approach is correct - you create a type in scriptland, e.g. by adding it to init-bare.bro, you then can add it to types.bif, and use it, either globally in bro.bif (which is a bit special), or if you are creating your own functions.bif, in there, after including types.bif.h. > I tried to the same but my bro script fails because my bif file doesn't > know about my record type. I included my 'types.bif.h' in my bif file get > it compiled without errors. But it fails to load because it does not know > about my record type. I get the error 'identifier not defined:'. Any help > is appreciated. Thanks. That sounds like more of a problem with the original definition of the type - where exactly did you define it? init-bare? Johanna ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/bif-example/4576/3 "2022-05-06T15:44:27Z")