HTTP2 Analyzer Plugin

Zeek
1

Hey there,

I tried to install the HTTP2 analyzer GitHub - MITRECND/bro-http2: Plugin for Zeek/Bro which provides http2 decoder/analyzer

But i get this error line 181: identifier not defined: http2_stream_stat

The problem is here

event http2_stream_end(c: connection, stream: count, stats: http2_stream_stat) &priority=5
{
c$http2_streams$streams[stream]$request_body_len = stats$request_body_length;
c$http2_streams$streams[stream]$response_body_len = stats$response_body_length;
Log::write(HTTP2::LOG, c$http2_streams$streams[stream]);
delete c$http2_streams$streams[stream];
delete c$http2_streams$has_data[stream];
}

I tried in many ways, is someone here who can help me or had the same issue,

Also after installation when i run “zeek -NN mitrecnd::HTTP2” I didn’t see any http2 Event, that means that the module is not installed properly ?

Thanks and see you in March in Geneva!

2

That error does not reproduce for me with what is in that archived repo. After I fixed its trivial C++ compilation errors (use std::string instead of string) it passes the test suite with zeek-8.1 for me.

Usually a good place to get more help about a package would be its GH repo, but the whole org has been archived by GH administrators. I am unsure what this implies for deploying this package as is in production.

3

Thanks Benjamin, the problem was about the installation, so I followed these steps

zkg install https://github.com/MITRECND/bro-http2

zkg install zeek/mitrecnd/bro-http2

Both of them and then worked, also now “zeek -NN mitrecnd::HTTP2” is working