delay pcap processing

Zeek
1

Hi,
I am trying to run in batch mode i.e. using ‘-r’ option. In my script, I am trying read some data into
bro from text file. As per the input framework documentation, reading data from file is an
asynchronous event, my packet processing is completing before I receive the Input::end_of_data
event. Is there a way to delay packet processing till file read is complete?

Thanks,
Dk

2

Call suspend_processing() from scriptland until your table is ready. Here’s an example:

https://github.com/anthonykasza/scratch_pad/tree/master/input_for_pcaps

-AK

3

Awesome! Thank you.