Bro Process Initialization and Stages

Zeek
1

Hi All,

I'm trying to determine the "stages" of a Bro process when invoked
from bro/bin/bro. I live mainly in scriptland and could be very wrong,
but in my mind things occur in the following order:

1. The Bro process is spawned.
2. The core does some initialization things (I'm guessing).
3. @ statements, including @load / @if / @idef / etc, are handled (in
order of appearance until all scripts are loaded).
4. Script land is initialized (all bro_init() events are handled by priority).
5. Export statements are handled making things globally available.
6. Packet processing in the core begins.
7. Events are raised by the core and handled by scriptland
(asynchronously and, again, by priority).
8. Scriptland terminates (all bro_done() events are handled by priority).
9. The core terminates (I'm assuming some garbage collection or clean
up happens here).
10. The Bro process dies.

In my mind I compare these stages to runlevels. I assume I'm missing
quite a few details. Perhaps someone here can add some insight into
each of these stages or stages I've overlooked. Thanks,

-Anthony

2

Anthony,

nice summary. One one correction: Step 5 happens earlier as the
scripts are parsed, i.e., as part of step 3. That's the reason for
having redef: in step 3 we can still change the value of constants,
afterwards we can't anymore.

Step 2 has internally become quite complex these days but that doesn't
really matter much from script-land perspective; it basically
preparares all the infrastructure that will later be needed. Step 9 is
the same in reverse (i.e., shutting down all the infrastructure
pieces).

Robin