# Interprocess Communication from BroScript

**URL:** <https://community.zeek.org/t/interprocess-communication-from-broscript/2846>\
**Category:** Zeek\
**Created:** [October 2, 2013, 5:08pm UTC](https://community.zeek.org/t/interprocess-communication-from-broscript/2846 "2013-10-02T17:08:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_Hook](https://avatars.discourse-cdn.com/v4/letter/j/e36b37/32.png) [@James\_Hook](https://community.zeek.org/u/James_Hook)\
**Post date:** [October 2, 2013, 5:08pm UTC](https://community.zeek.org/t/interprocess-communication-from-broscript/2846/1 "2013-10-02T17:08:00Z")

</div>

Hi all,

I have some C code that analyses data (inc. URLs, domains) that I want to invoke from Bro to extract additional data from network data. I envisage this data being an extra column in the resultant bro log files.

I’m fairly sure I can do this with awk retrospectively but wanted to ask the list whether it was possible using some of the IPC commands in the language. Reading the specifications for these functions there appears to be no way to invoke the commands and receive non-trivial output.

The commands i’m looking at are  
system,system\_env - returns the return code from the command (limited to being an integer) - i thought about returning the result into an environment variable, but that would require invoked command to be recompiled  
piped\_exec - only returns true/false on success failure

Has anybody else done anything similar?  
Are there anyways to load modules, call c functions (or functions in scripting languages) from the bro language?

Thanks in advance

James

---

<div class="post-metadata">

**Author:** ![Jim\_Mellander](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@Jim\_Mellander](https://community.zeek.org/u/Jim_Mellander)\
**Post date:** [October 2, 2013, 5:48pm UTC](https://community.zeek.org/t/interprocess-communication-from-broscript/2846/2 "2013-10-02T17:48:24Z")

</div>

Hi James:

Sounds like you could use the Broccoli library to perform the task you are envisioning: [http://www.bro.org/download/README.broccoli.html](http://www.bro.org/download/README.broccoli.html)

Jim Mellander  
NERSC Cybersecurity

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [October 2, 2013, 6:59pm UTC](https://community.zeek.org/t/interprocess-communication-from-broscript/2846/3 "2013-10-02T18:59:57Z")

</div>

Bro 2.2 beta has an exec module.

----script------  
redef exit\_only\_after\_terminate = T;

@load base/utils/exec  
event bro\_init()  
&nbsp;&nbsp;{  
&nbsp;&nbsp;when ( local result = Exec::run([$cmd="date"]) )  
&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;print result;  
&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;timeout 5secs  
&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;print "Hm, it didn't return.";  
&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;}  
-----end script-----

$ bro -b ./test-exec.bro  
[exit\_code=0, signal\_exit=F, stdout=[Wed Oct 2 14:59:02 EDT 2013], stderr=\<uninitialized\>, files=\<uninitialized\>]

.Seth

---

<div class="post-metadata">

**Author:** ![James\_Hook](https://avatars.discourse-cdn.com/v4/letter/j/e36b37/32.png) [@James\_Hook](https://community.zeek.org/u/James_Hook)\
**Post date:** [October 3, 2013, 3:03pm UTC](https://community.zeek.org/t/interprocess-communication-from-broscript/2846/4 "2013-10-03T15:03:01Z")

</div>

Thanks Seth, I think this is exactly what I need, so I’m going to install 2.2. Beta now!  
James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/interprocess-communication-from-broscript/2846/5 "2022-05-06T15:41:17Z")

</div>