# How BRO's in-built scripts are invoked in a flow one by one(one file after other file) **URL:** \ **Category:** Zeek\ **Created:** [December 6, 2015, 8:07am UTC](https://community.zeek.org/t/how-bros-in-built-scripts-are-invoked-in-a-flow-one-by-one-one-file-after-other-file/3931 "2015-12-06T08:07:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Aniket\_Savanand](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@Aniket\_Savanand](https://community.zeek.org/u/Aniket_Savanand)\ **Post date:** [December 6, 2015, 8:07am UTC](https://community.zeek.org/t/how-bros-in-built-scripts-are-invoked-in-a-flow-one-by-one-one-file-after-other-file/3931/1 "2015-12-06T08:07:57Z")
Hello, I am a student new to BRO. I am learning it by solving any simple use case. I am exploring practically how BRO’s internal function works . I could not find any links to internal working( practically, like where/when/which files are invoked one by one in general) Please redirect me to appropriate papers, links, documentation or examples Thanks Aniket Savanand San Jose State University (669-226-8162) ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [December 6, 2015, 6:28pm UTC](https://community.zeek.org/t/how-bros-in-built-scripts-are-invoked-in-a-flow-one-by-one-one-file-after-other-file/3931/2 "2015-12-06T18:28:40Z")
If you look at Bro’s main.cc file, you can see the two .bro script files it uses to bootstrap the rest of the policy scripts \< [https://github.com/bro/bro/blob/master/src/main.cc](https://github.com/bro/bro/blob/master/src/main.cc)\>. -AK ---
**Author:** ![Aniket\_Savanand](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@Aniket\_Savanand](https://community.zeek.org/u/Aniket_Savanand)\ **Post date:** [December 7, 2015, 1:07am UTC](https://community.zeek.org/t/how-bros-in-built-scripts-are-invoked-in-a-flow-one-by-one-one-file-after-other-file/3931/3 "2015-12-07T01:07:03Z")
Thanks for the reply. I got init-bare.bro and init-default.bro. Is there any way to see how these init-bare.bro and init-default.bro works stage by stage? I want to see how code gets run stepwise. Thanks Aniket Savanand San Jose State University (669-226-8162) ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [December 7, 2015, 1:52am UTC](https://community.zeek.org/t/how-bros-in-built-scripts-are-invoked-in-a-flow-one-by-one-one-file-after-other-file/3931/4 "2015-12-07T01:52:54Z")
You could try removing @load statements from those files one by one and see what happens. -AK ---
**Author:** ![Clark\_Gilbert](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Clark\_Gilbert](https://community.zeek.org/u/Clark_Gilbert)\ **Post date:** [December 7, 2015, 4:51am UTC](https://community.zeek.org/t/how-bros-in-built-scripts-are-invoked-in-a-flow-one-by-one-one-file-after-other-file/3931/5 "2015-12-07T04:51:14Z")
In addition to what Anthony suggests: Bro has an option to trace execution and write the results to a file: I think it's '-T' or something along those lines. The trace file generated by running bro with this option can show you which script functions were called and in which order they were called ... but this option generates a \*lot\* of output, and should therefore only be used offline and (probably) with a relatively small capture file. There's a benchmark script that ships with bro that also shows an example of incrementally running bro with 1 script loaded, 2 scripts loaded, etc to see how each script affects bro's runtime: [https://github.com/bro/bro-aux/blob/master/devel-tools/cpu-bench-with-trace](https://github.com/bro/bro-aux/blob/master/devel-tools/cpu-bench-with-trace) Also, maybe try taking a look at [try.bro.org](http://try.bro.org): it's a pretty nice way to play with bro and become familiar with how things work. Cheers, Gilbert ---
**Author:** ![Aniket\_Savanand](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@Aniket\_Savanand](https://community.zeek.org/u/Aniket_Savanand)\ **Post date:** [December 7, 2015, 4:57am UTC](https://community.zeek.org/t/how-bros-in-built-scripts-are-invoked-in-a-flow-one-by-one-one-file-after-other-file/3931/6 "2015-12-07T04:57:24Z")
Thanks a lot. I will look into these files. Thanks Aniket Savanand ---
**Author:** ![Aniket\_Savanand](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@Aniket\_Savanand](https://community.zeek.org/u/Aniket_Savanand)\ **Post date:** [December 13, 2015, 3:42am UTC](https://community.zeek.org/t/how-bros-in-built-scripts-are-invoked-in-a-flow-one-by-one-one-file-after-other-file/3931/7 "2015-12-13T03:42:39Z")
Thanks Anthony, Clark for your replies. I got BRO installed as per [https://www.digitalocean.com/community/tutorials/how-to-install-bro-ids-2-2-on-ubuntu-12-04](https://www.digitalocean.com/community/tutorials/how-to-install-bro-ids-2-2-on-ubuntu-12-04) on my linux dual boot machine. Now, I am able to run the BRO using broctl and I can see log files generated. And I played with [try.bro.org](http://try.bro.org) and saw how bro can capture traffic http, connection etc. I have succeeded doing above part only. Now at this stage, How do I proceed with suggestions you provided? I got many questions as ( 1 . So as Anthony suggested, to remove @load from these initial boot-strap files init-default.bro and init-bare.bro. But how do I that? I mean, where can I locate these files, and how do modify them to remove @load and make them run, but with my above installation. 1. As per Clark suggestion, I saw devel-tools list, but I could not figure out how do use : [https://github.com/bro/bro-aux/blob/master/devel-tools/cpu-bench-with-trace](https://github.com/bro/bro-aux/blob/master/devel-tools/cpu-bench-with-trace) in my current installation) Thanks Aniket Savanand San Jose State 669-226-8162 ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/how-bros-in-built-scripts-are-invoked-in-a-flow-one-by-one-one-file-after-other-file/3931/8 "2022-05-06T15:43:16Z")