Again, I’m adding the bro list for others edification. HTTP.cc is part of “the core”. It parses connection streams passed to it, from the analyzer tree, and raises events defined in events.bif. Such events include those around http headers, http requests, http responses, etc. Then, the script “laye…

init_bro is raised as Bro executes and HTTP events are rased as Bro sees HTTP connections. Usually the Bro binary needs to begin execution before it begins parsing network traffic. Here are some ideas for you to test: You could be terminating Bro before it recognizes an HTTP connection You could h…

so you mean to say that generate_http_request is a definition of HTTP_request event? void BifEvent::generate_http_request(analyzer::Analyzer* analyzer, Connection* c, StringVal* method, StringVal* original_URI, StringVal* unescaped_URI, StringVal* version) { // Note that it is intentional that he…

Because you didn't tell broctl to use -C. https://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums

Help with bro

Zeek

Topic		Replies	Views
can't get the http analyzer to print anything Zeek	3	118	May 6, 2022
http_request event Zeek	1	128	May 6, 2022
http.log event Zeek	2	106	May 6, 2022
http_request event Zeek	4	127	May 6, 2022
Help with Bro source code Zeek	3	105	May 6, 2022

Help with bro

Related topics