large Summary of Commands Note: all commands may be abbreviated with a unique prefix. Shortcuts below are special exceptions to this rule.
Command | Shortcut | Description
|
help | Get help with debugger commands
| |
quit | Exit Bro
| |
next | n | Step to the following statement, skipping function calls
|
step | s | Step to following statements, stepping in to function calls
|
continue | c | Resume execution of the policy script
|
finish | Run until the currently-executing function completes
| |
break | b | Set a breakpoint
|
condition | Set a condition on an existing breakpoint
| |
delete | d | Delete the specified breakpoints; delete all if no arguments
|
disable | Turn off the specified breakpoint; do not delete
permanently
| |
enable | Undo a prior `disable' command
| |
info | Get information about the debugging environment
| |
p | Evaluate an expression and print the result
| |
set | Alias for `print'
| |
backtrace | bt | Print a stack trace
|
frame | Select frame number N
| |
up | Select the stack frame one level up from the current one
| |
down | Select the stack frame one level down from the current one
| |
list | l | Print source lines surrounding specified context
|
trace | Turn on or off execution tracing
|
Table 9.1: Debugger Commands
Getting Help
help
command. Calling the command with no arguments displays a one-line
summary of each command.
Command-Line Options
-d
switch-d
switch enables the Bro
script debugger.
-t
switch-t
enables execution
tracing. There is an argument to the switch, which indicates a file
that will contain the result of the trace. Trace output consists of
the source code lines executed, indented for each nested function invocation.
Example. The following command invokes Bro, using tcpdump_file
for
the input packets and outputting the result of the trace to
execution_trace
.
./bro -t execution_trace -r tcpdump_file policy_script.bro
Example. If the argument to -t
is a single dash
character (“-
”), then the trace output is sent to
stderr
.
./bro -t - -r tcpdump_file policy_script.bro
Example. Lastly, execution tracing may be combined with the
debugger. Here we send output to stderr
, so it will be
intermingled with the debugger's output. Tracing may be turned off
and on in the debugger using the trace
command.
./bro -d -t - -r tcpdump_file policy_script.bro
Running the Script
Breakpoints
break | With no argument, the current line is used.
|
break [FILE:]LINE | The specified line in the specified file; if
no policy file is specified, the current file is implied.
|
break FUNCTION | The first line of the specified function or
event handler. If more than one event handler matches the name, a choice
will be presented.
|
break WILDCARD | Similar to FUNCTION, but a
POSIX-compliant regular expression (see the regex(3) man
page )is supplied, which is matched against all functions and event
handlers. One exception to the the POSIX syntax is that, as in the
shell, the * character may be used to match zero or more
of any character without a preceding period character (. ).
|
disable
command. If numeric
arguments separated by spaces are provided, the breakpoints with those
numbers will be enabled.
Debugger State
info
command to indicate which information is
desired. At present, the following subcommands are available:
info break | List all breakpoints and their status
|
Inspecting Program State
print
command and its alias,
set
, are used to evaluate any expression in the policy
script language. The result of the evaluation is printed
out. Results of the evaluation affect the current execution
environment; expressions may include things like assignment. The
expression is evaluated in the context of the currently selected
stack frame. The frame
, up
, and down
commands (below) are used to change the currently selected frame,
which defaults to the innermost one.
[FILE:]LINE The specified line in the specified file; if no policy file is specified, the current file is implied. \ FUNCTION The first line of the specified function or event handler. If more than one event handler matches the name, a choice will be presented. \ $\pm N$ With a numeric argument preceded by a plus or minus sign, the line at the supplied offset from the previously selected line.