[Bro] "Meta" event handling?

Robin Sommer robin at icir.org
Mon Jul 28 12:47:38 PDT 2008


On Fri, Jul 25, 2008 at 16:57 -0700, you wrote:

>     From within an event handler, is there a generic way to find out the 
> name of the event, and the names and types of the parameters that were 
> passed to the event?

You're asking about the Bro side, right? No, there isn't, and if I
understood correctly what you want to do I think it would be rather
tricky to implement it as Bro generally doesn't have much support
for such generic analysis at all. It relies almost completely on
static type checking which makes such things difficult. 

However, I'm not completely sure I got the idea of what you are
trying to achieve. Would it be possible to do this all within
another Broccoli client? Broccoli's interface provides you with most
of the information you look for (event name, argument types (though
not argumemtnames)). Could you write a Broccoli app that does the
wrapping?

Or asked differently, why can't you just send "normal" Bro events to
your Broccoli listener? It could subscribe to everything[1] and then
have generic event-handling code which does the neccessary steps.

Robin

[1] Subscribing to everything is actually not possible at the moment
but I have patch which adds that for Broccoli-to-Broccoli
connections and we could also implement it on the Bro side.

-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org



More information about the Bro mailing list