# can't get the http analyzer to print anything **URL:** \ **Category:** Zeek\ **Created:** [August 2, 2006, 9:37pm UTC](https://community.zeek.org/t/cant-get-the-http-analyzer-to-print-anything/1006 "2006-08-02T21:37:49Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Chandrashekar\_Jaidee](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@Chandrashekar\_Jaidee](https://community.zeek.org/u/Chandrashekar_Jaidee)\ **Post date:** [August 2, 2006, 9:37pm UTC](https://community.zeek.org/t/cant-get-the-http-analyzer-to-print-anything/1006/1 "2006-08-02T21:37:49Z")
Folks,    I'm having trouble running the http analyzer (in Bro 1-1) and would appreciate any help. Running bro in offline mode with tcpdump file (contains several sessions on port 80) as % bro -r trace\_incl-http.pcap http this creates an empty http log. NO http sessions show up! When I run bro with -t, the tracefile generated does not have any http events logged. Digging deeper, I see that in Sessions.cc; NetSessions::NewConn(..) //----snip-----//   case 1080:   case 3128: // Default port of Squid Proxy Cache.   case 8000:   case 8080:   case 8888:     if ( http\_request || http\_reply )       c = new HTTP\_Conn(this, k, t, id, tp); //-----snip----// the condition in the \_if\_ always evaluates to a false. \*question\*: Are http\_request and http\_reply, which are called here, defined somewhere? I couldn't grep for them in src/ I'm probably doing something very silly, but non-obvious:) Any pointers to what I might be missing/doing wrong? The pcap file and the (-t) trace file are attached. If it helps, I've attached the tracefile and also the connection log (by running the conn analyzer; this clearly shows http flows) cheers, -jc [bro.trace](https://community.zeek.org/uploads/short-url/hkdBTx5DC4XfouP3PUAI9T7qjhL.trace) (16.8 KB) [conn.log](https://community.zeek.org/uploads/short-url/s4rETF9F6oNwq3Fxx0s2QqeCevs.log) (3.88 KB) ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [August 2, 2006, 10:58pm UTC](https://community.zeek.org/t/cant-get-the-http-analyzer-to-print-anything/1006/2 "2006-08-02T22:58:04Z")
> % bro -r trace\_incl-http.pcap http Confusingly, you need to use   % bro -r trace\_incl-http.pcap http-request to see requests or   % bro -r trace\_incl-http.pcap http-reply to see requests & replies. You're not the first person to find this confusing, so I think for 1.2 we should change the scripts around so just using http pulls in full analysis.     Vern ---
**Author:** ![Chandrashekar\_Jaidee](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@Chandrashekar\_Jaidee](https://community.zeek.org/u/Chandrashekar_Jaidee)\ **Post date:** [August 3, 2006, 1:47am UTC](https://community.zeek.org/t/cant-get-the-http-analyzer-to-print-anything/1006/3 "2006-08-03T01:47:36Z")
Vern,    Thanks for the quick turn-around. Unfortunately, your suggestion doesn't seem to fix it! % bro -r trace\_incl-http.pcap http-request    also creates an empty http.log file (so also using http-reply) [your mail clarified things somewhat] I see a   ...   print http\_log fmt(... connection...)     in http-request.bro which should log the request in http.log However, i still don't see http-request events being generated in the (generated with -t) trace file. Also, here's a transcript of running in the debugger (the "new connection created" is printed in Sessions.cc, when the HTTP\_Conn constructor is called). // ----- % bro -d -r trace\_incl-http.pcap http-request Policy file debugging ON. In bro\_init() at /local/bro/policy/pcap.bro:99 99 update\_default\_pcap\_filter(); (Bro [0]) break http\_request Setting breakpoint on http\_request: Breakpoint 1 set at http\_request at /local/bro/policy/http-request.bro:60 (Bro [1]) continue Continuing. new connection created new connection created % // ----- [end]---- No http\_request events triggered. Any leads as to what I can try? Also, could you tell me exactly how "events" are called in the source code (a pointer to an instance where this is done would be great). I'm a little hazy about how the arguments are passed to the event handler. Is there an implicit mechanism to pass args? My confusion stems from http\_request being defined as taking 4 args (http-rw.bif.func\_def: run\_time("http\_request() takes exactly 4 argument(s)")), but I don't see the explicit call anywhere. cheers, -jc ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/cant-get-the-http-analyzer-to-print-anything/1006/4 "2022-05-06T15:37:56Z")