# icmp and bro

**URL:** <https://community.zeek.org/t/icmp-and-bro/32>\
**Category:** Zeek\
**Created:** [December 7, 1998, 4:35pm UTC](https://community.zeek.org/t/icmp-and-bro/32 "1998-12-07T16:35:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paul\_Howell](https://avatars.discourse-cdn.com/v4/letter/p/e0b2c6/32.png) [@Paul\_Howell](https://community.zeek.org/u/Paul_Howell)\
**Post date:** [December 7, 1998, 4:35pm UTC](https://community.zeek.org/t/icmp-and-bro/32/1 "1998-12-07T16:35:13Z")

</div>

Hello,

Before I get too far into this, I wanted check and see if anyone  
else is actively working on adding ICMP to bro?

I've started working on it and hope to be done pretty soon (famous  
last words!). Maybe I'm naive, but it doesn't look too hard.

NetSessions::NextPacket() looks like the best place to start.

I've got some very simple ICMP recognition code in place. I haven't  
looked at fragments or reassembly yet.

Regards.

\< paul

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/icmp-and-bro/32/2 "2022-05-06T15:36:04Z")

</div>