# SSL Events not being triggered

**URL:** <https://community.zeek.org/t/ssl-events-not-being-triggered/4916>\
**Category:** Zeek\
**Created:** [June 22, 2017, 7:42am UTC](https://community.zeek.org/t/ssl-events-not-being-triggered/4916 "2017-06-22T07:42:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shaanan\_Cohney](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@Shaanan\_Cohney](https://community.zeek.org/u/Shaanan_Cohney)\
**Post date:** [June 22, 2017, 7:42am UTC](https://community.zeek.org/t/ssl-events-not-being-triggered/4916/1 "2017-06-22T07:42:01Z")

</div>

I am having trouble getting any SSL events to trigger.

I’ve tested scripts against the snakeoil pcap from the wireshark sample pages, as well as my own data.

I’ve also tried scripts ranging from the one I actually plan to use, along with a few barebones ones.

When I use the -d flag and break on an connection I can see port 443 in the four tuple, but the SSL field remains uninitialized.

Here’s a sample of something I tried

event bro\_init(){  
#Analyzer::enable\_analyzer(Analyzer::ANALYZER\_SSL);  
#Analyzer::register\_for\_port(Analyzer::ANALYZER\_SSL, 443/tcp);  
}

event ssl\_established(c: connection) &priority=3 {  
print c;  
}

I’ve also tried my own compiled version of bro, and the apt package on the latest version of ubuntu.

I’m running bro as follows

bro -r a.pcap ./nameofscript.bro

Any help would be much appreciated!

Thanks,  
snc

---

<div class="post-metadata">

**Author:** ![Shaanan\_Cohney](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@Shaanan\_Cohney](https://community.zeek.org/u/Shaanan_Cohney)\
**Post date:** [June 22, 2017, 8:29am UTC](https://community.zeek.org/t/ssl-events-not-being-triggered/4916/2 "2017-06-22T08:29:07Z")

</div>

Solved it after a while.

All the pcaps I was using had invalid checksums.

If anyone comes across this thread with the same problem see [https://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums](https://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums)

> [Frequently Asked Questions - Bro](https://www.bro.org/documentation/faq.html#why-isn-t-bro-producing-the-logs-i-expect-a-note-about-checksums)  
> [www.bro.org](http://www.bro.org)  
> What is Bro? Bro provides a comprehensive platform for network traffic analysis, with a particular focus on semantic security monitoring at scale.  
> |
> 
> - |

Thanks!

---

<div class="post-metadata">

**Author:** ![Shaanan\_Cohney](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@Shaanan\_Cohney](https://community.zeek.org/u/Shaanan_Cohney)\
**Post date:** [June 22, 2017, 8:47am UTC](https://community.zeek.org/t/ssl-events-not-being-triggered/4916/3 "2017-06-22T08:47:56Z")

</div>

Still encountering the problem with another pcap.

Sorry for the extra message!

Any ideas?

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/ssl-events-not-being-triggered/4916/4 "2022-05-06T15:45:05Z")

</div>