# http\_request event

**URL:** <https://community.zeek.org/t/http-request-event/780>\
**Category:** Zeek\
**Created:** [June 19, 2005, 11:22pm UTC](https://community.zeek.org/t/http-request-event/780 "2005-06-19T23:22:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [June 19, 2005, 11:22pm UTC](https://community.zeek.org/t/http-request-event/780/1 "2005-06-19T23:22:03Z")

</div>

What exactly are you doing in your script? Note that "@load http" won't  
do it - you need "@load http-request" or "@load http-reply" to get  
request/replies, respectively.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![bchen](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@bchen](https://community.zeek.org/u/bchen)\
**Post date:** [June 20, 2005, 2:05am UTC](https://community.zeek.org/t/http-request-event/780/2 "2005-06-20T02:05:01Z")

</div>

Hi Vern,  
&nbsp;&nbsp;&nbsp;Thank you for your reply. I have actually loaded all http-related .bro files,  
including http, http-request, http-reply, http-body, etc. I load them in mt.bro  
and run Bro: ./bro -i eth0 mt. I then access a web server from the same machine  
where Bro is running. http-request and http-reply event handlers have never been  
called. Please be noted that I am doing these experiments in a close  
environment, a small LAN, which is connected together with a hub and  
disconnected from Internet. There are no DNS servers and Gateway here. The  
Communicatin is basically point-to-point. Is this environment affecting the  
functionality of the http analyzer?

thanks

Bing

Quoting Vern Paxson \<[vern@icir.org](mailto:vern@icir.org)\>:

---

<div class="post-metadata">

**Author:** ![Ruoming\_Pang](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@Ruoming\_Pang](https://community.zeek.org/u/Ruoming_Pang)\
**Post date:** [June 20, 2005, 2:24am UTC](https://community.zeek.org/t/http-request-event/780/3 "2005-06-20T02:24:09Z")

</div>

Hi, Bing,

Could you capture a piece of trace using 'tcpdump -w' (using '-s 5000' to make sure complete packets are capture) and run bro over the trace (with -r)? And if it doesn't work, please send us the trace and policy scripts you modified. It will help us understand what the problem is. Thanks!

Ruoming

---

<div class="post-metadata">

**Author:** ![bchen](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@bchen](https://community.zeek.org/u/bchen)\
**Post date:** [June 20, 2005, 3:27am UTC](https://community.zeek.org/t/http-request-event/780/4 "2005-06-20T03:27:19Z")

</div>

Hi Ruoming,  
&nbsp;&nbsp;&nbsp;Thank you for your reply. It turns out it is a checksum problem. Please refer  
to my description in my lastest email to Vern and this list. Does Bro filters  
out or ignore all bad checksum packets?

Bing

Quoting Ruoming Pang \<rpang@CS.Princeton.EDU\>:

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/http-request-event/780/5 "2022-05-06T15:37:31Z")

</div>