[Bro] question about plugin init

[Dk Jack]

could some please comment on my query.

Another related question, can two protocol analyzer modules register for
the same dpd signature? thanks.


On Mon, Aug 8, 2016 at 7:05 PM, Dk Jack <dnj0496 at gmail.com> wrote:

> Hi,
> I am trying write a bro analyzer plugin. My directory structure for my
> plugin is shown below.
> My scripts __load__.bro loads my init.bro and analyzer/test/test.bro. My
> test.bro file registers
> for 'event bro_init' in which I am registering for some ports. I can see
> both my bro scripts are
>
loaded in loaded_scripts.log. However, my bro_init event is never triggered
> and hence my
> ports are never registered. I can say my ports are not registered, because
> I put a print in my bro_init
>
function and I never see it. It doesn't complain even if I put
> syntactically incorrect code in my bro_init
>
function. Could someone shed some light on why my bro_init event is not
> getting triggered or if I am
> doing something wrong. Thanks.
>
> Dk.
>
> |-- __bro_plugin__
> |-- lib
> |   |-- analyzer-test.linux-x86_64.so
> |   `-- bif
> |       |-- __load__.bro
> |       |-- events.bif.bro
> |       `-- test.bif.bro
> `-- scripts
>     |-- __load__.bro
>     |-- analyzer
>     |   `-- test
>     |       |-- __load__.bro
>     |       `-- test.bro
>     `-- init.bro
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160809/fbf36d4d/attachment.html