# Help with Bro source code

**URL:** <https://community.zeek.org/t/help-with-bro-source-code/4440>\
**Category:** Zeek\
**Created:** [October 27, 2016, 9:37pm UTC](https://community.zeek.org/t/help-with-bro-source-code/4440 "2016-10-27T21:37:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yagyesh\_Srivastava](https://avatars.discourse-cdn.com/v4/letter/y/8edcca/32.png) [@Yagyesh\_Srivastava](https://community.zeek.org/u/Yagyesh_Srivastava)\
**Post date:** [October 27, 2016, 9:37pm UTC](https://community.zeek.org/t/help-with-bro-source-code/4440/1 "2016-10-27T21:37:44Z")

</div>

Hi,

I am trying to understand the bro events engine for HTTP.  
I see that the code has two places where http is handled:

1. build/src/protocol/http (files like [events.bif.cc](http://events.bif.cc) , [events.bif.init.cc](http://events.bif.init.cc) and [functions.bif.cc](http://functions.bif.cc))
2. src/protocol/http (files like HTTP.CC)

I am guessing the first one is the event engine and the second one is for handling the incoming HTTP packets. is that correct?

Does anyone know of a runtime analysis tool which would be helpful in this case?  
How do we generally go about to understand bro’s code base, i am just a beginner at this.  
Would really appreciate all the help.

Thanks,  
Yagyesh

---

<div class="post-metadata">

**Author:** ![Yagyesh\_Srivastava](https://avatars.discourse-cdn.com/v4/letter/y/8edcca/32.png) [@Yagyesh\_Srivastava](https://community.zeek.org/u/Yagyesh_Srivastava)\
**Post date:** [October 28, 2016, 12:33pm UTC](https://community.zeek.org/t/help-with-bro-source-code/4440/2 "2016-10-28T12:33:50Z")

</div>

Thanks Anthony.

I now have a basic understanding having gone through anthony kasza’s blog.

Can someone please help me with any kind of material/slides for understanding bro source code?  
Any other help/source would really help me a lot!

Thanks,  
Yagyesh

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [October 28, 2016, 3:43pm UTC](https://community.zeek.org/t/help-with-bro-source-code/4440/3 "2016-10-28T15:43:03Z")

</div>

I am not sure if you already found it - we have  
[https://www.bro.org/development/howtos/index.html](https://www.bro.org/development/howtos/index.html) on our webpage for a few  
pointers.

Apart from that, I don't think there is much that exists.

Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/help-with-bro-source-code/4440/4 "2022-05-06T15:44:12Z")

</div>