# Is there a way to intentionally delay Bro's reading of trace file for something else to finish first? **URL:** \ **Category:** Zeek\ **Created:** [October 9, 2017, 10:10pm UTC](https://community.zeek.org/t/is-there-a-way-to-intentionally-delay-bros-reading-of-trace-file-for-something-else-to-finish-first/5056 "2017-10-09T22:10:39Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Ren\_Wenyu](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@Ren\_Wenyu](https://community.zeek.org/u/Ren_Wenyu)\ **Post date:** [October 9, 2017, 10:10pm UTC](https://community.zeek.org/t/is-there-a-way-to-intentionally-delay-bros-reading-of-trace-file-for-something-else-to-finish-first/5056/1 "2017-10-09T22:10:39Z")
Hello all, I am recently using pybroker to feed some event data to my python program. I use the auto\_event to do that and read traffic from a pcap file. However, it takes some time for the broker to establish the connection with my python program but the processing of the traffic starts immediately. As a result, the first part of the traffic is always missing in my python program. The following is how I set up the connection and the utilize the auto\_event. I am wondering if there is a way to intentionally delay Bro's processing of the pcap file so that the connection can be established before Bro start to process the traffic. event bro\_init() &priority=5 {     Broker::enable();     Broker::connect("127.0.0.1", broker\_port, 1sec);     Broker::auto\_event("bro/event/packet\_get", FlowLevel::packet\_get);     Broker::auto\_event("bro/event/data\_get", DataLevel::data\_get); } Any help is appreciated. Thanks a lot. Best, Wenyu Wenyu Ren Ph.D. Candidate Department of Computer Science University of Illinois at Urbana-Champaign ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [October 9, 2017, 10:33pm UTC](https://community.zeek.org/t/is-there-a-way-to-intentionally-delay-bros-reading-of-trace-file-for-something-else-to-finish-first/5056/2 "2017-10-09T22:33:20Z")
You can try something like this, not sure if it will work though event resume() {     continue\_processing(); } event bro\_init() &priority=5 {     # your existing stuff     suspend\_processing();     schedule 10secs { resume() }; } You may want to look at the suggestion I wrote up here: [http://mailman.icsi.berkeley.edu/pipermail/bro/2017-July/012355.html](http://mailman.icsi.berkeley.edu/pipermail/bro/2017-July/012355.html) Having a 'pcapdir' pktsource plugin would solve a lot of problems like this. ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [October 9, 2017, 11:03pm UTC](https://community.zeek.org/t/is-there-a-way-to-intentionally-delay-bros-reading-of-trace-file-for-something-else-to-finish-first/5056/3 "2017-10-09T23:03:56Z")
Here’s a solution I hacked up a couple of years back while trying to scan pcaps for indicators. I believe it’s very similar to what Justin replied with. [https://github.com/anthonykasza/scratch\_pad/blob/master/input\_for\_pcaps/README.md](https://github.com/anthonykasza/scratch_pad/blob/master/input_for_pcaps/README.md) -AK ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [October 10, 2017, 1:16pm UTC](https://community.zeek.org/t/is-there-a-way-to-intentionally-delay-bros-reading-of-trace-file-for-something-else-to-finish-first/5056/4 "2017-10-10T13:16:47Z")
You could use the bro\_done event to send a "EXIT" message to your python listener telling it that bro is done running and it should exit. The problem with the port sounds like something is not setting SO\_REUSEADDR inside broker. ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [October 10, 2017, 4:48pm UTC](https://community.zeek.org/t/is-there-a-way-to-intentionally-delay-bros-reading-of-trace-file-for-something-else-to-finish-first/5056/5 "2017-10-10T16:48:51Z")
Just to point out one thing to prevent future annoyance on your part - broker is currently getting a re-write which includes changed python APIs. The new version of Broker will be used in Bro 2.6 and the old API will no longer work. The current state is not yet merged into master, but you can look at topic/actor-system of the broker repository; the best point probably are the tests in [https://github.com/bro/broker/tree/topic/actor-system/tests/python](https://github.com/bro/broker/tree/topic/actor-system/tests/python) It might be worth to take a short look at the new syntax just so that you know how you might have to adapt things in the future. Johanna ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [October 10, 2017, 4:52pm UTC](https://community.zeek.org/t/is-there-a-way-to-intentionally-delay-bros-reading-of-trace-file-for-something-else-to-finish-first/5056/6 "2017-10-10T16:52:17Z")
I just wanted to point out that the Bro unit tests themselves also use an approach like this. See for example [https://github.com/bro/bro/blob/master/testing/btest/scripts/policy/frameworks/intel/seen/certs.bro](https://github.com/bro/bro/blob/master/testing/btest/scripts/policy/frameworks/intel/seen/certs.bro) Johanna ---
**Author:** ![Ren\_Wenyu](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@Ren\_Wenyu](https://community.zeek.org/u/Ren_Wenyu)\ **Post date:** [October 10, 2017, 7:18pm UTC](https://community.zeek.org/t/is-there-a-way-to-intentionally-delay-bros-reading-of-trace-file-for-something-else-to-finish-first/5056/7 "2017-10-10T19:18:23Z")
Hi Justin, Thanks for the reply. That’s also what I planned to do. Do you have any idea what function is used at the python side to close the connection? The toy example in the test folder does not have that part included. Thanks a lot. Best, Wenyu ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [October 10, 2017, 8:01pm UTC](https://community.zeek.org/t/is-there-a-way-to-intentionally-delay-bros-reading-of-trace-file-for-something-else-to-finish-first/5056/8 "2017-10-10T20:01:20Z")
Just exiting your while loop and letting things get garbage collected should probably work.. failing that, it would be something like epl.close() or epl.disconnect() ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/is-there-a-way-to-intentionally-delay-bros-reading-of-trace-file-for-something-else-to-finish-first/5056/9 "2022-05-06T15:45:20Z")
Closed on May 6, 2022, 3:45pm UTC