# Zeek broker and spicy script not working in 6.1.1

**URL:** <https://community.zeek.org/t/zeek-broker-and-spicy-script-not-working-in-6-1-1/7271>\
**Category:** Zeek\
**Tags:** spicy\
**Created:** [February 7, 2024, 3:27pm UTC](https://community.zeek.org/t/zeek-broker-and-spicy-script-not-working-in-6-1-1/7271 "2024-02-07T15:27:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![biswa61](https://avatars.discourse-cdn.com/v4/letter/b/f08c70/32.png) [@biswa61](https://community.zeek.org/u/biswa61)\
**Post date:** [February 7, 2024, 3:27pm UTC](https://community.zeek.org/t/zeek-broker-and-spicy-script-not-working-in-6-1-1/7271/1 "2024-02-07T15:27:56Z")

</div>

Hi,  
I have installed latest zeek 6.1.1 ( spicyc 1.9.0 and spicyz 6.1.1 ) release. I am facing issue publishing data over broker for spicy script. The same script is working fine in both zeek 6.0.0 ( spicyz 6.0.0 , spicyc 1.8.1) and zeek 6.2.0-dev.147 ( spicyz version 6.2.0-dev.147 , spicyc version v1.9.0-dev.157 ). I have compiled [iec104](https://github.com/georgemakrakis/zeek-iec104) and installed iec104.hlto and published over the broker and received in another end point ( did the same thing for 6.0.0, 6.1.1 and 6.2.0-dev.147). Strange thing is that zeek script without using spicy is working fine with the broker in 6.1.1 but not the spicy script which is running fine in other two zeek versions. It seems there is some issue with this spicy version ?

Thanks  
Biswa

---

<div class="post-metadata">

**Author:** ![Benjamin\_Bannier](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/benjamin_bannier/32/595_2.png) [@Benjamin\_Bannier](https://community.zeek.org/u/Benjamin_Bannier)\
**Post date:** [February 7, 2024, 3:51pm UTC](https://community.zeek.org/t/zeek-broker-and-spicy-script-not-working-in-6-1-1/7271/2 "2024-02-07T15:51:56Z")

</div>

Spicy knows nothing about Broker so your issue is elsewhere, but it is impossible to tell where from the information you have shared. If you would share a **minimal** example we might be able to help you, see e.g., [here](https://stackoverflow.com/help/minimal-reproducible-example) for how to create a good example.

Please invest your time to reduce your example **as much as possible** and do not share your full code like in other questions. This increases the chances of you getting the help you are looking for by a lot.

FTR, a previous discussion was [Packet processing doubt in spicy parser and zeek broker](https://community.zeek.org/t/packet-processing-doubt-in-spicy-parser-and-zeek-broker/7233).

---

<div class="post-metadata">

**Author:** ![biswa61](https://avatars.discourse-cdn.com/v4/letter/b/f08c70/32.png) [@biswa61](https://community.zeek.org/u/biswa61)\
**Post date:** [February 7, 2024, 6:39pm UTC](https://community.zeek.org/t/zeek-broker-and-spicy-script-not-working-in-6-1-1/7271/3 "2024-02-07T18:39:52Z")

</div>

Hi @Benjamin_Bannier ,  
I am doing the exact same thing with other zeek version, but getting published message in another python end point subscriber.  
I am using [georgemakrakis/zeek-iec104: A Zeek Parser for the IEC 104 protcol built using Spicy. (github.com)](https://github.com/georgemakrakis/zeek-iec104) for this test. Just added 3 steps as below

step 1: ip, port for connecting peer.  
`event zeek_init() &priority=5`  
` {`  
` suspend_processing();`  
` Broker::peer(addr_to_uri(127.0.0.1), 50003/tcp);`  
`.....`  
` }`

Step 2: Started processing once peer is connected …

`event Broker::peer_added(ep: Broker::EndpointInfo, msg: string)`  
`{`  
` print "PEER ADDED", ep;`  
` continue_processing();`

`} `  
Step 3: publishing message from an event

`event iec104::apci ()`  
`{`  
`....`  
`Broker::publish("/topic/iec104", iec_parsed, c);`  
`....`  
`}`

and just receiving message in another python script  
` self.ep = broker.Endpoint()`  
` self.sub = self.ep.make_subscriber("/topic/iec104")`  
` self.ss = self.ep.make_status_subscriber(True)`  
` self.ep.listen("127.0.0.1", 50003)`  
` .....`  
once connected dump the message

The same scripts are running fine with other zeek versions.

Is there any native zeek spicy parser and broker script which I can try with 6.1.1, to confirm?

Please let me know if you need any other input to give feedback to this problem.  
Thanks  
Biswa

---

<div class="post-metadata">

**Author:** ![Benjamin\_Bannier](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/benjamin_bannier/32/595_2.png) [@Benjamin\_Bannier](https://community.zeek.org/u/Benjamin_Bannier)\
**Post date:** [February 7, 2024, 8:15pm UTC](https://community.zeek.org/t/zeek-broker-and-spicy-script-not-working-in-6-1-1/7271/4 "2024-02-07T20:15:15Z")

</div>

It is still not clear to me what issue you are running into. I tried the following:

```auto
event zeek_init() &priority=5
	{
	suspend_processing();
	Broker::peer(addr_to_uri(127.0.0.1), 50003/tcp);
	}

event Broker::peer_added(ep: Broker::EndpointInfo, msg: string)
	{
	print "PEER ADDED", ep;
	continue_processing();
	}

# No need for the IEC104 package, any triggered event should work.
event connection_established(c: connection)
	{
	print "PUBLISHING";
	Broker::publish("/topic/test", connection_established, c);
	}

```

```python
#!/usr/bin/env python3

import broker

ep = broker.Endpoint()
sub = ep.make_subscriber("/topic/test")
ss = ep.make_status_subscriber(True)
ep.listen("127.0.0.1", 50003)

print(sub.get())

```

I first started the Python script, and then run Zeek against a PCAP containing connections so `connection_established` is triggered. The Python script receives a value both with zeek-6.0.0 and zeek-6.1.1.

---

<div class="post-metadata">

**Author:** ![biswa61](https://avatars.discourse-cdn.com/v4/letter/b/f08c70/32.png) [@biswa61](https://community.zeek.org/u/biswa61)\
**Post date:** [February 8, 2024, 2:55pm UTC](https://community.zeek.org/t/zeek-broker-and-spicy-script-not-working-in-6-1-1/7271/5 "2024-02-08T14:55:50Z")

</div>

Hi @Benjamin_Bannier ,  
As I told in my first message that normal zeek scripts using broker framework were working but not spicy scripts. That’s why I referred the iec104. It’s a spicy parser, so what I assumed is that there might be some issue in sending parsed iec104 data over the broker that is coming from spicy parser. But, I might be wrong here. I will test in another machine setting up zeek 6.1.1 and let you know.

Thanks  
Biswa
