<font size="2"><font face="times new roman,serif">Hi, <br><br>I think Bro-pipe is a special Broccoli client. So I try to test to run Bro-pipe to see its effect. I can run it in older version of Bro (1.5) based on 2009 workshop exercise. But when I follow the same step and run it in Bro (1.6), nothing show up. I observe two situations:<br>
<br>1. directly run Bro binary without indicating interface<br>if I run Bro through command /usr/local/bro/bin/bro *.bro (without indicating interface), <br>In Bro 1.5, after executing this command, Bro will continue execution.<br>
But in Bro 1.6, Bro will terminate immediately. Is that the right phenomenon? <br><br>2. run bro-pipe to send event to Bro instance<br>In Bro 1.5, I just first run command<br></font></font><font size="2"><font face="times new roman,serif">/usr/local/bro/bin/bro *.bro (let Bro run) <br>
and run bro-pipe<br></font></font><font size="2"><font face="times new roman,serif">/usr/local/bro/bin/bropipe host=<a href="http://127.0.0.1:47758" target="_blank">127.0.0.1:47757</a> -f *.bro-pipe<br>And Bro can detect event<br>
<br>But in Bro 1.6, I need to run command<br></font></font><font size="2"><font face="times new roman,serif">/usr/local/bro/bin/bro -i eth0 *.bro (let Bro run) </font></font><br><font size="2"><font face="times new roman,serif">and run bro-pipe<br>
</font></font><font size="2"><font face="times new roman,serif">/usr/local/bro/bin/bropipe host=<a href="http://127.0.0.1:47758/" target="_blank">127.0.0.1:47757</a> -f *.bro-pipe (I also try port 47758)<br>But Bro-pipe just stick there and there is even no warning such as "could not connect Bro at ...". Bro does not detect any event<br>
</font></font><font size="2"><font face="times new roman,serif"><br>So how can I run Bro-Pipe in Bro 1.6 <br>
</font></font><br clear="all">
<br>-- <br>Hui Lin<br>Research Assistant<br>DEPEND Research Group, ECE Department<br>University of Illinois at Urbana-Champaign<br><a href="mailto:hlin33@illinois.edu" target="_blank">hlin33@illinois.edu</a><br>