[Bro] Plugin doesn't seem te get instantiated

Robin Sommer robin at icir.org
Mon Aug 24 08:57:54 PDT 2015



On Sun, Aug 23, 2015 at 15:40 +0000, you wrote:

> Is this all that is required? The plugin still doesn't do anything...
> Any hints? Or does anyone have an example non-built-in plugin that
> work on all connections regardless of ports and signatures?

Sounds like you're suspecting the right thing already: the analyzer
needs to be explicitly activated for all connections it's supposed to
look at, it's not going to receive everything automatically. There
there 4 ways to activate an analyzer: (1) by port, (2) by signature,
(3) in script-land for a future connection, and (4) with recent git
master you can write a C++ hook function that gets called once at the
beginning of each connection when the default analyzer setup has been
determined; that C++ function can then add the customer analyzer at
that point as well.

The interface for (1)-(3) is documented here
https://www.bro.org/sphinx/scripts/base/frameworks/analyzer/main.bro.html.

For (4), this is the merge commit (not further documented yet).

Robin

-- 
Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin


More information about the Bro mailing list