[Bro] Bro Process Initialization and Stages

Robin Sommer robin at icir.org
Fri Feb 7 07:42:09 PST 2014


Anthony,

nice summary. One one correction: Step 5 happens earlier as the
scripts are parsed, i.e., as part of step 3. That's the reason for
having redef: in step 3 we can still change the value of constants,
afterwards we can't anymore.

Step 2 has internally become quite complex these days but that doesn't
really matter much from script-land perspective; it basically
preparares all the infrastructure that will later be needed. Step 9 is
the same in reverse (i.e., shutting down all the infrastructure
pieces).

Robin

On Thu, Feb 06, 2014 at 18:42 -0800, you wrote:

> Hi All,
> 
> I'm trying to determine the "stages" of a Bro process when invoked
> from bro/bin/bro. I live mainly in scriptland and could be very wrong,
> but in my mind things occur in the following order:
> 
> 1. The Bro process is spawned.
> 2. The core does some initialization things (I'm guessing).
> 3. @ statements, including @load / @if / @idef / etc, are handled (in
> order of appearance until all scripts are loaded).
> 4. Script land is initialized (all bro_init() events are handled by priority).
> 5. Export statements are handled making things globally available.
> 6. Packet processing in the core begins.
> 7. Events are raised by the core and handled by scriptland
> (asynchronously and, again, by priority).
> 8. Scriptland terminates (all bro_done() events are handled by priority).
> 9. The core terminates (I'm assuming some garbage collection or clean
> up happens here).
> 10. The Bro process dies.
> 
> In my mind I compare these stages to runlevels. I assume I'm missing
> quite a few details. Perhaps someone here can add some insight into
> each of these stages or stages I've overlooked. Thanks,
> 
> -Anthony
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> 


-- 
Robin Sommer * Phone +1 (510) 722-6541 *     robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 * www.icir.org/robin



More information about the Bro mailing list