Summary of Commands
Note: all commands may be abbreviated with a unique prefix. Shortcuts
below are special exceptions to this rule.
Command | Shortcut | Description |
---|---|---|
help | Get help with debugger commands | |
quit | Exit Bro | |
next | n | Step to the following statement, skipping function calls |
step | s | Step to following statements, stepping in to function calls |
continue | c | Resume execution of the policy script |
finish | Run until the currently-executing function completes | |
break | b | Set a breakpoint |
condition | Set a condition on an existing breakpoint | |
delete | d | Delete the specified breakpoints; delete all if no arguments |
disable | Turn off the specified breakpoint; do not delete permanently | |
enable | Undo a prior `disable' command | |
info | Get information about the debugging environment | |
p | Evaluate an expression and print the result | |
set | Alias for `print' | |
backtrace | bt | Print a stack trace |
frame | Select frame number N | |
up | Select the stack frame one level up from the current one | |
down | Select the stack frame one level down from the current one | |
list | l | Print source lines surrounding specified context |
trace | Turn on or off execution tracing |
Getting Help
Command-Line Options
Example. The following command invokes Bro, using tcpdump_file for the input packets and outputting the result of the trace to execution_trace.
./bro -t execution_trace -r tcpdump_file policy_script.bro
Example. If the argument to -t is a single dash character (``-''), then the trace output is sent to stderr.
./bro -t - -r tcpdump_file policy_script.bro
Example. Lastly, execution tracing may be combined with the debugger. Here we send output to stderr, so it will be intermingled with the debugger's output. Tracing may be turned off and on in the debugger using the trace command.
./bro -d -t - -r tcpdump_file policy_script.bro
Running the Script
Breakpoints
break | With no argument, the current line is used. |
break [FILE:]LINE | The specified line in the specified file; if no policy file is specified, the current file is implied. |
break FUNCTION | The first line of the specified function or event handler. If more than one event handler matches the name, a choice will be presented. |
break WILDCARD | Similar to FUNCTION, but a POSIX-compliant regular expression (see the regex(3) man page )is supplied, which is matched against all functions and event handlers. One exception to the the POSIX syntax is that, as in the shell, the * character may be used to match zero or more of any character without a preceding period character (.). |
Debugger State
info break | List all breakpoints and their status |
Inspecting Program State
[FILE:]LINE | The specified line in the specified file; if no policy file is specified, the current file is implied. |
---|---|
FUNCTION | The first line of the specified function or event handler. If more than one event handler matches the name, a choice will be presented. |
![]() |
With a numeric argument preceded by a plus or minus sign, the line at the supplied offset from the previously selected line. |