[Bro] Policy debug

fu yiyang fuyiyang at gmail.com
Sat Sep 20 06:41:35 PDT 2008


hi all!
When I used Dynamic Protocol Detection, I found can't activate event handler
http_request. If commentted use_dpd, the event can be activated.
The next is my process in detail.The bro version is 1.2.1-stable.
The cmd line is : src/bro -d -r (pcap) http_lite.bro
case 1:
comment const use_dpd = T in http_lite.bro
Policy file debugging ON.
set breakpoint at http-request.bro:http_request
Then input c cmd, bro can hit breakpoint http_request.
case 2:
uncomment const use_dpd = T in http_lite.bro
set breakpoint at http-request.bro:http_request and
detect-protocols-http.bro:http_request.
Then input c cmd, bro hit neither and finish.

 Could someone can tell the reason?
  Thanks very much!

 Regards
eyoung
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20080920/018e8c21/attachment.html 


More information about the Bro mailing list