Policy debug

Zeek
1

hi all!
When I used Dynamic Protocol Detection, I found can’t activate event handler http_request. If commentted use_dpd, the event can be activated.
The next is my process in detail.The bro version is 1.2.1-stable.
The cmd line is : src/bro -d -r (pcap) http_lite.bro
case 1:
comment const use_dpd = T in http_lite.bro
Policy file debugging ON.
set breakpoint at http-request.bro:http_request
Then input c cmd, bro can hit breakpoint http_request.
case 2:
uncomment const use_dpd = T in http_lite.bro
set breakpoint at http-request.bro:http_request and detect-protocols-http.bro:http_request.
Then input c cmd, bro hit neither and finish.

Could someone can tell the reason?
Thanks very much!

Regards
eyoung

2

The cmd line is : src/bro -d -r (pcap) http_lite.bro

What is http_lite.bro?

In particular, the problem you are running into sounds like the packet-capture
filter isn't set to a value that matches the traffic you want to analyze.
You can see what the filter is by adding print-filter.bro to your command
line, which will cause Bro to print the filter and exit.

Also note that the interactive debugger (-d) has not been maintained for
a while and has some significant problems :-(, so unfortunately you shouldn't
trust it for tracking down script bugs.

    Vern