[Bro] using broccoli to receive events to bro

Siwek, Jon jsiwek at illinois.edu
Wed Jul 23 09:31:19 PDT 2014


On Jul 23, 2014, at 10:42 AM, roi hatam <roihat168 at yahoo.com> wrote:

> I'm trying to connect with broccoli and intercept http requests.
> 
> static void
> http_request_c(BroConn *conn, void *data, ... /*BroRecord *c, BroString *method, BroString *original_URI, BroString *unescaped_URI, BroString *version*/){
>     seqcheck++;
>     fprintf(stdout, "inside http_request_c");
>     fflush(stdout);
> 
>     conn = NULL;
>     data = NULL;
> }

At least one thing that appears to be missing is that this callback is never registered, so it’s not linked to any event generated in Bro.  Doing that (sometime before your bro_conn_connect() call) will probably look something like:

	bro_event_registry_add(bc, “http_request", (BroEventFunc) http_request_c, NULL);

- Jon



More information about the Bro mailing list