[Bro] Plugin doesn't seem te get instantiated
Robin Sommer
robin at icir.org
Mon Aug 24 08:57:54 PDT 2015
On Sun, Aug 23, 2015 at 15:40 +0000, you wrote:
> Is this all that is required? The plugin still doesn't do anything...
> Any hints? Or does anyone have an example non-built-in plugin that
> work on all connections regardless of ports and signatures?
Sounds like you're suspecting the right thing already: the analyzer
needs to be explicitly activated for all connections it's supposed to
look at, it's not going to receive everything automatically. There
there 4 ways to activate an analyzer: (1) by port, (2) by signature,
(3) in script-land for a future connection, and (4) with recent git
master you can write a C++ hook function that gets called once at the
beginning of each connection when the default analyzer setup has been
determined; that C++ function can then add the customer analyzer at
that point as well.
The interface for (1)-(3) is documented here
https://www.bro.org/sphinx/scripts/base/frameworks/analyzer/main.bro.html.
For (4), this is the merge commit (not further documented yet).
Robin
--
Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin
More information about the Bro
mailing list