[Bro] Implementing broping.c in broscript

James Hook jamesfhook at gmail.com
Thu Oct 10 02:11:13 PDT 2013

Thanks Seth, i knew it had to be possible.
I'm struggling to get it working. Do you have any examples in the
frameworks where this is done, or can you pick out anything missing from
what i've already tried.
Thanks in advance for any help you can give with this.

broping_clt.bro (starting using "bro broping_clt.bro" after "bro
broping.bro" has been started in another terminal)
"broping.bro" is as in the broccoli 1.93 source.
i am wanting this script to send a ping event to "broping" and for it to
handle a pong event coming back (as broping.c does)

global pong: event(src_time: time, dst_time: time, seq: count);
global ping: event(src_time: time, seq: count);

redef Communication::nodes += {
    ["broping2"] = [$host =, $p = 47758/tcp, $events = /pong/,
$connect=T, $ssl=F]

event bro_init()
        #local w : count = connect(
        #, "",    47758/tcp,    "",    5secs,     F    );

        event ping(current_time(), 1);

event pong(src_time: time, dst_time: time, seq: count)
        print "pong!!!";

On 9 October 2013 21:55, Seth Hall <seth at icir.org> wrote:

> On Oct 9, 2013, at 4:31 PM, James Hook <jamesfhook at gmail.com> wrote:
> > I guess i'm asking is whether it is possible (or even whether it is a
> good idea) to implement broping.c in broscript.
> You can definitely do that.  It would just be sending events between
> multiple Bro processes which is very regularly done in some of the
> frameworks we ship.
>   .Seth
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20131010/0c36b886/attachment.html 

More information about the Bro mailing list