# icmp events (custom and original) not firing? **URL:** \ **Category:** Zeek\ **Created:** [March 2, 2015, 11:02pm UTC](https://community.zeek.org/t/icmp-events-custom-and-original-not-firing/3504 "2015-03-02T23:02:37Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Scott\_Wells](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@Scott\_Wells](https://community.zeek.org/u/Scott_Wells)\ **Post date:** [March 2, 2015, 11:02pm UTC](https://community.zeek.org/t/icmp-events-custom-and-original-not-firing/3504/1 "2015-03-02T23:02:37Z")
Hello. I am writing a C++ program to interface with Bro, using Broccoli. According to this [Bro] Mailing List message ([http://mailman.icsi.berkeley.edu/pipermail/bro/2014-December/007844.html](http://mailman.icsi.berkeley.edu/pipermail/bro/2014-December/007844.html)), I need to create my own events that only use certain fields from the conn\_id bro record. I followed the example in the post, using the ‘dns\_message’ event as a test. 1. In bro/share/bro/base/bif/plugins/Bro\_DNS.events.bif.bro, I added this line after line 26: global dns\_message\_test: event(cid: conn\_id, is\_orig: bool , msg: dns\_msg , len: count ); 1. In bro/share/bro/base/protocols/dns/main.bro, in the ‘event dns\_message’ event (ln 286), I added this at the bottom of the event: event dns\_message\_test(c$id, is\_orig, msg, len); Then, in my main function, I add it to the registry with something like: bro\_event\_registry\_add\_compact(f\_broPtr, “dns\_message\_test”, (BroCompactEventFunc) event\_cb, NULL); And my ‘event\_cb’ callback function is called and everything seems good. However, I then wanted to try with icmp\_time\_exceeded and icmp\_packet\_too\_big (which is part of what I’m after): In bro/share/bro/base/bif/plugins/Bro\_ICMP.events.bif.bro, I add a ‘\_test’ event to both: global icmp\_packet\_too\_big\_test: event(cid: conn\_id , icmp: icmp\_conn , code: count , context: icmp\_context ); global icmp\_time\_exceeded\_test: event(cid: conn\_id , icmp: icmp\_conn , code: count , context: icmp\_context ); However: 1. There is only one ‘event icmp\*’ function block, and that’s in /bro/share/bro/policy/misc/detect-traceroute/main.bro for ‘icmp\_time\_exceeded’. This has an associated ‘event icmp\_time\_exceeded’ (line 98). I add my ‘icmp\_time\_exceeded\_test(c$id, icmp, code, context)’ line in that function and register it with another bro\_event\_registry\_add\_compact line in my C code, but the event (original and my \_test version) never fires. I’m not sure I’m using the correct ‘event icmp’ since the detect-traceroute comments say it’s for a Time Exceeded threshold, and I’m more interested in capturing ANY Time exceeded event. 2. Given 1), I cannot find a ‘main.bro’ file with ‘event icmp\_packet\_too\_big’, and so that event (original and \_test version) never fires, either. I am very new to DPI, so I may be missing something obvious. Any help greatly appreciated. Thanks! -Scott ---
**Author:** ![Scott\_Wells](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@Scott\_Wells](https://community.zeek.org/u/Scott_Wells)\ **Post date:** [March 2, 2015, 11:16pm UTC](https://community.zeek.org/t/icmp-events-custom-and-original-not-firing/3504/2 "2015-03-02T23:16:26Z")
I should also mention that we are firing pcaps that contain ICMP Oversize and Time Exceeded data, but it could be that they need to be configured in Bro. -Scott Ps: Pls excuse the Confidentiality Notice. It’s auto-generated from my company. ---
**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\ **Post date:** [March 3, 2015, 5:04pm UTC](https://community.zeek.org/t/icmp-events-custom-and-original-not-firing/3504/3 "2015-03-03T17:04:11Z")
Are you sure that policy/misc/detect-traceroute/main.bro is loaded ? E.g. if you’re running from command line it won’t be loaded by default, you’d need something like: bro -r icmp.pcap misc/detect-traceroute/main.bro This is sort of a detour from the specific problem, but rather than modifying existing scripts, I’d suggest defining your own event handlers for the ones you need. I’d try to get something simple working from the command-line first. E.g. create a file called “test.bro” containing: event icmp\_time\_exceeded(c: connection, icmp: icmp\_conn, code: count, context: icmp\_context)   {   print "icmp\_time\_exceeded", c$id, icmp, code, context;   } Then run: bro -r icmp.pcap ./test.bro If you see output, then it works and you can modify the handler however you need. If not, then there’s something specific about the pcap you’re using that I’d probably need to see in order to tell what’s wrong, but sometimes weird.log might have hints as to what’s wrong. - Jon ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/icmp-events-custom-and-original-not-firing/3504/4 "2022-05-06T15:42:29Z")