[Bro] broccoli tests

[Mike Muratet]

Hello Again

Well, this is a lot like a scene in a Hitchcock movie where they do that 
thing with the lens that makes the hallway seem to get longer and longer.

I have tried a few more things. It appears to me that my local.site.bro is 
not getting called. I can use broping.bro or broping-record.bro as my 
starting policy in bro.cfg and I can verify that bro is listening on 47758 
with nmap. I can capture the transactions with tcpdump per Scott's 
recommendation and I can see that there are 7 messages from 127.0.0.1:34102 
to 127.0.0.1:47758 with replies. I forget how to interpret the payloads, but 
I'll go back and read the manual. In any event, all the combinations of 
broping.bro, broping-record.bro and broping -r return "Could not connect to 
bro at 127.0.0.1:47758".

So, I reconfigured bro with bro_config. It sets the start policy to 
localhost.localdomain.bro and I gave it an empty file. I'm not sure I'm 
entirely clear as to the purpose of this parameter, but that's OK--I don't 
think that's where the problem lies. With this configuration, the broping 
script is not getting called and it looks to me that local.site.bro is not 
getting called. I put print and log statements in it and I don't see 
anything on standard out or in the logs.

So, does local.site.bro get called automatically or do I have to coerce it 
with a load statement? If I can make sure bro is configured properly then 
maybe the rest will fall into place. I notice that bro_config writes some 
network information into local.site.bro. What happens to bro if this 
information is not available?

Thanks

Mike