[Bro-Dev] Bare Mode

anthony kasza anthony.kasza at gmail.com
Thu Nov 21 19:33:46 PST 2013


Hey All,

Looking at the diff between the output of the two commands I was
slightly surprised.

bro -e 'event bro_script_loaded(script: string, levels: count) { print
script; }'
bro -be 'event bro_script_loaded(script: string, levels: count) {
print script; }'

I'm curious if Bro in bare mode is ever used for anything. I'm not
surprised to see bare mode include bifs. Is there a design decision
why bare mode includes things like the input and logging framework but
not the protocol directories that make use of them (e.g.
bro/base/protocols/conn) ?

-AK


More information about the bro-dev mailing list