# React based on Bro event (block/unblock connection) **URL:** \ **Category:** Zeek\ **Created:** [November 15, 2018, 5:29am UTC](https://community.zeek.org/t/react-based-on-bro-event-block-unblock-connection/5528 "2018-11-15T05:29:20Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Mohammed\_Alshaboti](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@Mohammed\_Alshaboti](https://community.zeek.org/u/Mohammed_Alshaboti)\ **Post date:** [November 15, 2018, 5:29am UTC](https://community.zeek.org/t/react-based-on-bro-event-block-unblock-connection/5528/1 "2018-11-15T05:29:20Z")
```auto Hi, I would like to send Bro data (e.g. connection) to a backend python program on some events. I tried to use the netcontrol broker to communicate with an external python client like ([https://github.com/bro/bro-netcontrol/tree/master/test](https://github.com/bro/bro-netcontrol/tree/master/test) ). But when I added event it crashed. ``` ---
**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\ **Post date:** [November 15, 2018, 5:02pm UTC](https://community.zeek.org/t/react-based-on-bro-event-block-unblock-connection/5528/2 "2018-11-15T17:02:35Z")
Can you provide more info? e.g. exact code that you're trying. Was it bro or the python program that crashed? Any other relevant output or error messages? - Jon ---
**Author:** ![Mohammed\_Alshaboti](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@Mohammed\_Alshaboti](https://community.zeek.org/u/Mohammed_Alshaboti)\ **Post date:** [November 17, 2018, 12:47am UTC](https://community.zeek.org/t/react-based-on-bro-event-block-unblock-connection/5528/3 "2018-11-17T00:47:47Z")
Hi Jone, I modified the code many times, and couldn’t reproduce the error. Simply I modified this [https://github.com/bro/bro-netcontrol/blob/master/test/simple-test.bro](https://github.com/bro/bro-netcontrol/blob/master/test/simple-test.bro) to add event [https://github.com/bro/bro-netcontrol/blob/master/test/simple-client.py](https://github.com/bro/bro-netcontrol/blob/master/test/simple-client.py) I would like to add rules inside ‘connection\_established()’ event rather than in netControl::init(), so python script can react based on established connection\_established event. “” @load base/frameworks/netcontrol redef exit\_only\_after\_terminate = T; event NetControl::init() { local netcontrol\_broker = NetControl::create\_broker(NetControl::BrokerConfig($host=127.0.0.1, $bport=9977/tcp, topic="bro/event/ne NetControl::activate(netcontrol\_broker, 0); } event NetControl::init\_done() &priority=-5 { print “Init done”; # drop rule goes through to simple-client.py NetControl::drop\_address(1.1.2.2, 15sec, “Hi there”); } event connection\_established(c: connection) { # can’t receive this drop in simple-client.py, only it gets connectionestablished not the drop rule!! NetControl::drop\_address(1.1.2.2, 15sec, “Hi there”); } “” however, I only on python client I get connection\_established but not the drop rule of NetControl::drop\_address I run it like this: bro -C -r ../traces/tls/ecdhe.pcap simple-test.bro python simple-client.py │netcontrol-3-ssh-guesser.bro todo.txt DEBUG:netcontrol.api:Set up listener for [127.0.0.1:9977](http://127.0.0.1:9977) (bro/event/net│netcontrol-9-skeleton.bro weird.log control-example) │netcontrol-9-use-skeleton.bro x509.log DEBUG:netcontrol.api:Waiting for broker message… │netcontrol.log DEBUG:netcontrol.api:Handling broker status message… │pi@raspberrypi:~/test\_bro $ INFO:netcontrol.api:Incoming connection established │rm \*.log \ Thank you, Mohammed The python program crash or give me communication established ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [November 17, 2018, 2:39am UTC](https://community.zeek.org/t/react-based-on-bro-event-block-unblock-connection/5528/4 "2018-11-17T02:39:49Z")
You may be running into a common race condition where the pcap file is read before the netcontrol broker connection is initialized. There are 2 ways of going about testing this differently. The first way would be to run bro on live traffic by using -i eth0 instead of reading a pcap file. I would also change NetControl::drop\_address(1.1.2.2, 15sec, “Hi there”); to NetControl::drop\_address(c$id$resp\_h, 15sec, “Hi there”); so that for each connection bro sees it will try to drop a different address and not just 1.1.2.2 each time. I believe netcontrol tracks drops internally so by dropping the same 1.1.2.2 each time you would only see one broker message every 15 seconds instead of each time. If you need to test using a pcap file you should be able to use the method that is used in the test suite: [https://github.com/bro/bro/blob/master/testing/btest/scripts/base/frameworks/netcontrol/broker.bro](https://github.com/bro/bro/blob/master/testing/btest/scripts/base/frameworks/netcontrol/broker.bro) Essentially you would add a event bro\_init() { suspend\_processing(); } so that bro pauses processing of the pcap traffic as soon as it starts. Then, inside NetControl::init\_done you would call continue\_processing(). This way the pcap is only analyzed after netcontrol is fully initialized. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/react-based-on-bro-event-block-unblock-connection/5528/5 "2022-05-06T15:46:11Z")