# Help with bro

**URL:** <https://community.zeek.org/t/help-with-bro/4507>\
**Category:** Zeek\
**Created:** [November 24, 2016, 6:32am UTC](https://community.zeek.org/t/help-with-bro/4507 "2016-11-24T06:32:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\
**Post date:** [November 24, 2016, 6:32am UTC](https://community.zeek.org/t/help-with-bro/4507/1 "2016-11-24T06:32:54Z")

</div>

Again, I’m adding the bro list for others edification.

HTTP.cc is part of “the core”. It parses connection streams passed to it, from the analyzer tree, and raises events defined in events.bif. Such events include those around http headers, http requests, http responses, etc. Then, the script “layer” is called based on those events. Such events have handler code in scripts that do things such as logging. I hope this helps.

-AK

---

<div class="post-metadata">

**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\
**Post date:** [November 24, 2016, 8:03am UTC](https://community.zeek.org/t/help-with-bro/4507/2 "2016-11-24T08:03:47Z")

</div>

init\_bro is raised as Bro executes and HTTP events are rased as Bro sees HTTP connections. Usually the Bro binary needs to begin execution before it begins parsing network traffic. Here are some ideas for you to test:

- You could be terminating Bro before it recognizes an HTTP connection
- You could have no traffic going to Bro (do you see a conn.log file? Are we sure about interfaces at this point?)
- You may be generating HTTP traffic Bro doesn’t recognize.

Collect a pcap and attach to this thread. Best case scenario, you found a protocol parsing issue and the Bro devs can fix. Worst case scenario, your SO distribution need tweaking and you may need to ask another list for directions.

-AK

---

<div class="post-metadata">

**Author:** ![Yagyesh\_Srivastava](https://avatars.discourse-cdn.com/v4/letter/y/8edcca/32.png) [@Yagyesh\_Srivastava](https://community.zeek.org/u/Yagyesh_Srivastava)\
**Post date:** [November 24, 2016, 9:44am UTC](https://community.zeek.org/t/help-with-bro/4507/3 "2016-11-24T09:44:55Z")

</div>

**so you mean to say that generate\_http\_request is a definition of HTTP\_request event?**

void BifEvent::generate\_http\_request(analyzer::Analyzer\* analyzer, Connection\* c, StringVal\* method, StringVal\* original\_URI, StringVal\* unescaped\_URI, StringVal\* version)  
{  
// Note that it is intentional that here we do not  
// check if ::http\_request is NULL, which should happen _before_  
// BifEvent::generate\_http\_request is called to avoid unnecessary Val  
// allocation.

val\_list\* vl = new val\_list;

vl-\>append(c-\>BuildConnVal());  
vl-\>append(method);  
vl-\>append(original\_URI);  
vl-\>append(unescaped\_URI);  
vl-\>append(version);

mgr.QueueEvent(::http\_request, vl, SOURCE\_LOCAL, analyzer-\>GetID(), timer\_mgr, c);  
}

**if thats the case, why does it have mgr.QueueEvent, that gets me confused.**  
**And the HTTP\_request event is raised by:**

void HTTP\_Analyzer::HTTP\_Request() { ProtocolConfirmation(); const char\* method = (const char\*) request\_method-\>AsString()-\>Bytes(); int method\_len = request\_method-\>AsString()-\>Len(); if ( strncasecmp(method, “CONNECT”, method\_len) == 0 ) connect\_request = true; if ( http\_request ) { val\_list\* vl = new val\_list; vl-\>append(BuildConnVal()); Ref(request\_method); vl-\>append(request\_method); vl-\>append(TruncateURI(request\_URI-\>AsStringVal())); vl-\>append(TruncateURI(unescaped\_URI-\>AsStringVal())); vl-\>append(new StringVal(fmt("%.1f", request\_version))); // DEBUG\_MSG("%.6f http\_request\n", network\_time); ConnectionEvent(http\_request, vl); } }

I have attached the responses inline to what asked to test:

Here are some ideas for you to test:

- You could be terminating Bro before it recognizes an HTTP connection

When i use bro -Ci eth0 (i.e. the binary ), then i can see all the http.log, weird.log,conn.log files getting dumped in my current working directory. They have the correct information. So I dont think this is the case. Still can’t get why Broctl wouldnt give me the logs

- You could have no traffic going to Bro (do you see a conn.log file? Are we sure about interfaces at this point?)

As mentioned traffic is going to bro, only then i am able to see those logs.

- You may be generating HTTP traffic Bro doesn’t recognize.

Doubt This.

Having said the above, what I did as means of a small experiment was to write a small code to open a file and print a line having function name in each of the event definitions in [events.bif.cc](http://events.bif.cc) and each of the events in HTTP.cc, just to get a trace of the function calls, but it just shows me bro\_init as the printed message.  
**Again I am confused as to how its able to detect the HTTP packets without passing through either of these functions?**

Thanks,  
Yagyesh

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [November 24, 2016, 1:18pm UTC](https://community.zeek.org/t/help-with-bro/4507/4 "2016-11-24T13:18:24Z")

</div>

Because you didn't tell broctl to use -C.

[https://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums](https://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/help-with-bro/4507/5 "2022-05-06T15:44:19Z")

</div>