% Document Type: LaTeX

% $Header: /home/jaguar/u0/vern/bro/bro-doc/RCS/doc.tex,v 1.21 2002/11/16 01:26:03 vern Exp vern $

\documentclass[twoside]{report}
% \psdraft

% The following magic turns off extra spacing after punctuation.  We
% actually want extra spacing after periods, but *not* after colons.
% I don't know how to achieve just the latter.
\frenchspacing

% Allow a bit more leeway on page breaks.
\sloppy

\usepackage{makeidx}
\usepackage{times}
\usepackage{psfig}
\usepackage{html}

\textwidth=6.5in
\oddsidemargin=-0.15in
\evensidemargin=-0.15in

\title{
	The {\em Bro} 0.8 User Manual
}
\latexhtml{
\author{
	Vern Paxson \\
	Lawrence Berkeley National Laboratory \\
	and \\
	ICSI Center for Internet Research \\
	International Computer Science Institute \\
	vern@icir.org
}
}{}

\newcommand{\note}[1]{\emph{Note: #1}}
\newcommand{\privatenote}[1]{}
\newcommand{\updateme}[1]{#1}
\newcommand{\unlikeC}[1]{\emph{Unlike with C,} #1}
\newcommand{\deficiency}[1]{\emph{Deficiency: #1}}
\newcommand{\fixme}[1]{\emph{Fix me: #1}}

\latexhtml{
\newcommand{\xref}[1]{\S~\ref{#1}, page~\pageref{#1}}
\newcommand{\pxref}[1]{(\S~\ref{#1}, page~\pageref{#1})}
\newcommand{\cxref}[1]{Chapter~\ref{#1}, page~\pageref{#1}}
% \newcommand{\axref}[1]{\xref{#1}}
% \newcommand{\apxref}[1]{\pxref{#1}}
\newcommand{\axref}[1]{}
\newcommand{\apxref}[1]{}
\newcommand{\link}[2]{{#1}\apxref{#2}}
\newcommand{\lab}[2]{#2\label{#1}}
\newcommand{\labsectchapter}[2]{\chapter{#1 #2}}
\newcommand{\labsectsection}[2]{\section{#1 #2}}
\newcommand{\labsectsubsection}[2]{\subsection{#1 #2}}
\newcommand{\labsectsubsubsection}[2]{\subsubsection{#1 #2}}
\newcommand{\itemwithextra}[3]{\item[{\tt #1}]{#2}}
\newcommand{\optsyntax}[1]{{\textrm{[} \texttt{#1} \textrm{]}}}
\newcommand{\nl}[0]{~ \\}
\def\see#1#2{{\em see\/} #1}
}{
\newcommand{\xref}[1]{\hyperref{\S~\ref{#1}}{}{}{#1}}
\newcommand{\pxref}[1]{(\xref{#1})}
\newcommand{\cxref}[1]{\hyperref{Chapter~\ref{#1}}{}{}{#1}}
\newcommand{\link}[2]{\hyperref{#1}{}{}{#2}}
\newcommand{\lab}[2]{\label{#1}{#2}}
\newcommand{\labsectchapter}[2]{\chapter{#2 #1}}
\newcommand{\labsectsection}[2]{\section{#2 #1}}
\newcommand{\labsectsubsection}[2]{\subsection{#2 #1}}
\newcommand{\labsectsubsubsection}[2]{\subsubsection{#2 #1}}
\newcommand{\itemwithextra}[3]{\item[{\tt #1#3}]}
\newcommand{\optsyntax}[1]{{\emph{[} \texttt{#1} \emph{]}}}
\newcommand{\nl}[0]{}
}

\newcommand{\itemwithtype}[2]{\itemwithextra{#1}{\tt{}:\ #2}{ : #2}}

\newcommand{\f}[1]{Figure~\ref{#1}}
\newcommand{\tbl}[1]{Table~\ref{#1}}
\newcommand{\percent}[0]{{{\tt \%}}}
\newcommand{\hash}[0]{{{\tt \#}}}
\newcommand{\caret}[0]{{{\tt \^}}}
\newcommand{\load}[0]{{{\tt @load}{ }}}
\newcommand{\loadx}[0]{{{\tt @load}}}
\newcommand{\prefix}[0]{{{\tt @prefix}{ }}}
\newcommand{\prefixx}[0]{{{\tt @prefix}}}
\newcommand{\void}[0]{void}

% For some reason, if this is in-lined into doc.idx, makeindex gets upset.
\newcommand{\kludge}[0]{{\tt \mbox{\hspace{0.01in}}~}}

\newcommand{\indplain}[2]{\index{#1 #2}\index{#2s!#1}{#1}}
\newcommand{\indtt}[2]{\index{#1 #2@{\protect\tt #1} #2}\index{#2s}\index{#2s!#1@{\tt #1}}{{\tt #1}}}
\newcommand{\indttbang}[2]{\index{#1@{\tt #1}}\index{#1!#2@#2}{{\tt #1}}}
\newcommand{\indttparen}[2]{\index{#1 #2@{\protect\tt (#1)} #2}\index{#2s}\index{#2s!#1@{\tt (#1)}}{{\tt (#1)}}}
\newcommand{\indttnotext}[2]{\index{#1 #2@{\protect\tt #1} #2}\index{#2s}\index{#2s!#1@{\tt #1}}}
\newcommand{\indttnotexttwo}[3]{\index{#1 #2 #3@{\protect\tt #1 #2} #3}\index{#2 #3@{\tt #2} #3}\index{#2 #3!#1@{\tt #1}}}
\newcommand{\indttzero}[1]{\index{#1@{\protect\tt #1}}{{\tt #1}}}
\newcommand{\indtttwo}[3]{\index{#2@{\protect\tt #1} #3}\index{#3s}\index{#3s!#2@{\tt #1}}}
\newcommand{\itemindtt}[2]{\index{#1 #2@{\protect\tt #1} #2}\index{#2s}\index{#2s!#1@{\tt #1}}\item[{\tt #1}]\nl}
\newcommand{\indttbegin}[2]{\index{#1 #2@{\protect\tt #1} #2|(}\index{#2s}\index{#2s!#1@{\tt #1}|(}{\tt #1}}
\newcommand{\indttend}[2]{\index{#1 #2@{\protect\tt #1} #2|)}\index{#2s}\index{#2s!#1@{\tt #1}|)}{\tt #1}}

% \newcommand{\opind}[1]{\index{{\tt #1} #1 operator@{\protect\tt #1} operator}}
% \newcommand{\indopone}[2]{\index{{\tt #1} #1 #2@{\protect\tt #1} #2}}
% \newcommand{\indoponekey}[3]{\index{{\tt #1} #3@{\protect\tt #1} #2}}
% \newcommand{\indoptwo}[2]{\index{{\tt #1} #1 #2@{\protect\tt #1\protect\ } #2}}

\newcommand{\opind}[1]{\index{#1 operator@{\protect\tt #1} operator}\index{operators!{\protect\tt #1}}}
\newcommand{\indopone}[2]{\index{#1 #2@{\protect\tt #1} #2}\index{operators!{\protect\tt #1}}}
\newcommand{\indoponekey}[3]{\index{#3@{\protect\tt #1} #2}\index{operators!{\protect\tt #1}}}
\newcommand{\indoptwo}[2]{\index{#1 #2@{\protect\tt #1\protect\ } #2}\index{operators!{\protect\tt #1}}}

\newcommand{\keyind}[1]{\index{#1 keyword@{\protect\tt #1} keyword}\index{keywords!{\protect\tt #1}}}

\newcommand{\indevent}[2]{\index{#1 event@{\protect\tt #1} event}\index{events!{\protect\tt #1}}\lab{#2-event}{{\tt #1}}}
\newcommand{\itemindevent}[2]{\index{#1 event@{\protect\tt #1} event}\index{events!{\protect\tt #1}}\lab{#2-event}{\item[{\tt #1}]\nl}}
\newcommand{\indeventnolabel}[1]{\index{#1 event@{\protect\tt #1} event}\index{events!{\protect\tt #1}}}
\newcommand{\indeventtype}[3]{\index{#1 event@{\protect\tt #1} event}\index{events!{\protect\tt #1}}\lab{#2-event}{\itemwithextra{\tt #1}{\tt{}(#3)}{ (#3)}\nl}}
\newcommand{\indeventtypenolabel}[2]{\index{#1 event@{\protect\tt #1} event}\index{events!{\protect\tt #1}}\itemwithextra{\tt #1}{\tt{}(#2)}{ (#2)}\nl}
\newcommand{\xrefevent}[2]{\link{\tt #1}{#2-event}}
\newcommand{\xrefindevent}[2]{\index{#1 event@{\protect\tt #1} event}\index{events!{\protect\tt #1}}\link{\tt #1}{#2-event}}

\newcommand{\indenvnotext}[1]{\index{#1 environment variable@{\protect\tt \$#1} environment variable}\index{environment variables!#1@{\tt \$#1}}}
\newcommand{\indenv}[2]{\indenvnotext{#1}\lab{#2-env}{{\tt \$#1}}}
\newcommand{\itemindenv}[2]{\indenvnotext{#1}\lab{#2-env}{\item[{\tt \$#1}]} \nl}
\newcommand{\xrefenv}[2]{\link{\tt \$#1}{#2-env}}

\newcommand{\analyzer}[1]{{\tt #1}}
\newcommand{\indanalyzer}[2]{\index{#1 analyzer@{\protect\tt #1} analyzer}\index{analyzers!{\protect \tt #1}}\lab{#2-analyzer-module}{{\tt #1}}}
\newcommand{\indanalyzernolabel}[1]{{\index{#1 analyzer@{\protect\tt #1} analyzer}\index{analyzers!{\protect \tt #1}}{\tt #1}}}
\newcommand{\xrefanalyzer}[2]{\link{\tt #1}{#2-analyzer-module}}

\newcommand{\module}[1] {{\tt #1}}
\newcommand{\indmodule}[2]{\index{#1 module@{\protect\tt #1} module}\index{modules!{\protect \tt #1}}\lab{#2-analyzer-module}{{\tt #1}}}
\newcommand{\xrefmodule}[2]{\link{\tt #1}{#2-analyzer-module}}

\newcommand{\indfunc}[2]{\index{#1 function@{\protect\tt #1} function}\index{functions!{\protect \tt #1}}\lab{#2-func}{{\tt #1}}}
\newcommand{\itemindfunc}[3]{\index{#1 function@{\protect\tt #1} function}\index{functions!{\protect \tt #1}}\lab{#2-func}{\itemwithextra{\tt #1}{\tt #3 }{\tt #3 }\nl}}
\newcommand{\indfuncnolabel}[2]{\index{#1 function@{\protect\tt #1} function}\index{functions!{\protect \tt #1}}{\tt #1}}
\newcommand{\xreffunc}[2]{\link{\tt #1}{#2-func}}
\newcommand{\xrefindfunc}[2]{\index{#1 function@{\protect\tt #1} function}\index{functions!{\protect \tt #1}}\xreffunc{#1}{#2}}
\newcommand{\xreffuncnott}[2]{\xref{#2-func}}

\newcommand{\xreflog}[1]{\link{\tt #1}{#1-log}}

\newcommand{\itemindstmtemph}[1]{\index{#1 statement@{\protect\emph{#1}} statement}\index{statements!{\protect\emph{#1}}}\lab{#1-stmt}{\item[{\emph{#1}}]\nl}}
\newcommand{\itemindstmttt}[1]{\index{#1 statement@{\protect\tt #1} statement}\index{statements!{\protect\tt #1}}\lab{#1-stmt}{\item[{\tt #1}]\nl}}
\newcommand{\itemindstmttttwo}[2]{\index{#1 statement@{\protect\tt #1} statement}\index{#2 statement@{\protect\tt #2} statement}\index{statements!{\protect\tt #1}}\index{statements!{\protect\tt #2}}\label{#1-stmt}\label{#2-stmt}{\item[{\tt #1}, {\tt #2}]\nl}}
\newcommand{\xrefstmt}[2]{\link{\tt #1}{#2-stmt}}

\newcommand{\itemindexpremph}[1]{\index{#1 expression@{\protect\emph{#1}} expression}\index{expressions!{\protect\emph{#1}}}\lab{#1-expr}{\item[{\emph{#1}}]\nl}}
\newcommand{\itemindexprtt}[1]{\index{#1 expression@{\protect\tt #1} expression}\index{expressions!{\protect\tt #1}}\lab{#1-expr}{\item[{\tt #1}]\nl}}
\newcommand{\itemindexprtttwo}[2]{\index{#1 expressions@{\protect\tt #1} expressions}\index{#2 expressions@{\protect\tt #2} expressions}\index{expressions!{\protect\tt #1}}\index{expressions!{\protect\tt #2}}\label{#1-expr}\label{#2-expr}{\item[{\tt #1}, {\tt #2}]\nl}}
\newcommand{\itemindexpremphtwo}[2]{\index{#1 expressions@{\protect\em #1} expressions}\index{#2 expressions@{\protect\em #2} expressions}\index{expressions!{\protect\em #1}}\index{expressions!{\protect\em #2}}\label{#1-expr}\label{#2-expr}{\item[{\em #1}, {\em #2}]\nl}}
\newcommand{\itemindexprtttwonott}[2]{\index{#1 expressions@{#1} expressions}\index{#2 expressions@{#2} expressions}\index{expressions!{#1}}\index{expressions!{#2}}\label{#1-expr}\label{#2-expr}{\item[{#1}, {#2}]\nl}}
\newcommand{\xrefexpr}[2]{\link{\tt #1}{#2-expr}}

\newcommand{\indfield}[4]{\index{#1@{\tt #1}}\index{#1!#3@{\tt #3} field}\index{#3 record@{\tt #3} record}\lab{#4-#2-field}{\item[{\tt #1}]\nl}}
\newcommand{\xreffield}[3]{\link{\tt #1}{#3-#2-field}}
\newcommand{\xrefscript}[2]{\link{\tt #1}{#2-script}}

\newcommand{\indvar}[1]{\index{#1 variable@{\protect\tt #1} variable}\index{variables!{\protect \tt #1}}{\tt #1}}
\newcommand{\indvartype}[3]{\index{#1 variable@{\protect\tt #1} variable}\index{variables!{\protect \tt #1}}\lab{#2-var}{\itemwithtype{\tt #1}{#3}\nl}}
\newcommand{\indvarbegin}[1]{\index{#1 variable@{\tt #1} variable|(}\index{variables!{\protect \tt #1}|(}}
\newcommand{\indvarend}[1]{\index{#1 variable@{\tt #1} variable|)}\index{variables!{\protect \tt #1}|)}}
\newcommand{\xrefvar}[2]{\link{\tt #1}{#2-var}}
\newcommand{\xrefvarnott}[2]{\xref{#2-var}}
\newcommand{\pxrefvarnott}[2]{\pxref{#2-var}}

\newcommand{\xreftype}[2]{\link{\tt #1}{#2-type}}

\newcommand{\indattr}[2]{\index{#1 attribute@{\protect\tt \&#1} attribute}\index{attributes!#1@{\tt \&#1}}\lab{#2-attr}{{\tt \&#1}}}
\newcommand{\indattrnotext}[1]{\index{#1 attribute@{\protect\tt \&#1} attribute}\index{attributes!#1@{\tt \&#1}}}
\newcommand{\itemindattr}[2]{\indattrnotext{#1}\lab{#2-attr}{\item[{\tt \&#1}]} \nl}
\newcommand{\xrefattr}[2]{\link{\tt \&#1}{#2-attr}}

\newcommand{\indintvar}[1]{\index{#1 internal variable@{\protect\tt #1} internal variable}\index{internal variables!{\protect \tt #1}}{\tt #1}}

\newcommand{\indformat}[1]{\index{#1 format@{\protect\tt #1} format}\index{format!#1@{\tt #1}}\item[#1]\nl}
\newcommand{\indformatnoitem}[1]{\index{#1 format@{\protect\tt #1} format}\index{format!#1@{\tt #1}}}

\newcommand{\indweird}[2]{\index{#1 (``weird'' event)@{\protect\tt #1} (``weird'' event)}\index{weird event@``weird'' event}\index{weird event!#1@{\protect \tt #1}}\lab{#2-weird}{\item[{\tt #1}]}\nl}

\newcommand{\indextext}[2]{\index{#1 (#2)@{\protect\tt "#1"} (#2)}\index{#2s}\index{#2s!#1@{\tt "#1"}}{\tt "#1"}}
\newcommand{\indexmsg}[1]{\index{#1@{\protect\tt "#1"}}\index{message!{\protect \tt "#1"}}}

\newcommand{\indfatal}[1]{\index{#1!fatal run-time error}\index{fatal run-time error!#1}\index{run-time error!#1}}
\newcommand{\indruntime}[1]{\index{#1!run-time error}\index{run-time error!#1}}

\newcommand{\indglobalnotext}[1]{{\index{#1 global variable@{\protect\tt #1} global variable}}{\index{global variables!{\protect\tt #1}}}}
\newcommand{\indglobal}[1]{\indglobalnotext{#1}{\tt #1}}

\newcommand{\indpredefvar}[3]{\index{#1 variable@{\protect\tt #1} variable}\index{predefined variables!{\protect \tt #1}}\index{variables!{\protect \tt #1}}\lab{#2-global}{\itemwithtype{\tt #1}{#3}\nl}}

\newcommand{\xrefglobal}[2]{\link{\tt #1}{#2-global}}
\newcommand{\xrefglobalind}[2]{\link{\tt #1}{#2-global}\indglobalnotext{#1}}

\newcommand{\indlibrary}[2]{{\index{#1 library@{\protect\em #1} library}}{\index{libraries!{\protect\em #1}}}{\index{libraries!{\protect\em #1}}}\lab{#2-library}{{\em #1}}}
\newcommand{\xreflibrary}[2]{\link{\emph{#1}}{#2-library}}

\newcommand{\indutility}[2]{{\index{#1 utility program@{\protect\em #1} utility program}}{\index{programs!{\protect\em #1}}}{\index{utility programs!{\protect\em #1}}}\lab{#2-utility}{{\em #1}}}
\newcommand{\xrefutility}[2]{\link{\emph{#1}}{#2-utility}}

\newcommand{\mkflagind}[1]{\index{#1 flag@{\protect\tt -#1} flag}\index{flags!{\protect \tt -#1}}\index{Bro!flags!{\protect \tt -#1}}}
\newcommand{\indflag}[1]{\mkflagind{#1}\lab{flag-#1}{\item[{\tt -#1}]\nl}}
\newcommand{\indflagnoitem}[1]{\mkflagind{#1}{\tt -#1}}
\newcommand{\indflagtwo}[2]{\mkflagind{#1}\lab{flag-#1}{\itemwithextra{\tt -#1}{ \emph{#2}}{ \emph{#2}} \\}}
\newcommand{\xrefflag}[1]{\link{\tt #1}{flag#1}}

\newcommand{\indpredeffunc}[3]{\index{#1 function@{\tt #1} function}\index{predefined functions!{\protect \tt #1}}\index{functions!{\protect \tt #1}}\lab{#2-func}{\itemwithextra{\tt #1}{\tt{}#3 }{ #3}\nl}}
\newcommand{\indpredeffuncnolab}[2]{\index{#1 predefined function@{\tt #1} predefined function}\index{predefined functions!{\protect \tt #1}}\index{functions!{\protect \tt #1}}\itemwithextra{\tt #1}{\tt{}#2 }{ #2}\nl}

\newcommand{\indtype}[1]{\index{#1@{\protect\tt #1}|see{types, {\protect\tt #1}}}}

\newcommand{\indconfig}[2]{\index{#1 configuration option@{\tt {--}#1} configuration option}\index{configuration options!{\tt {--}#1}}\lab{#2-config}{{\tt {--}#1}}}
\newcommand{\xrefconfig}[2]{\link{\tt {--}#1}{#2-config}}

\newcommand{\addindextocentry}[0]{\addcontentsline{toc}{chapter}{\protect\numberline{Index}{}}}

\makeindex

\begin{document}
\maketitle

\html{
\begin{center}
	Vern Paxson \\
	Lawrence Berkeley National Laboratory \\
	and \\
	ICSI Center for Internet Research \\
	International Computer Science Institute \\
	vern@icir.org
\end{center}
}

%begin{latexonly}
{\pagestyle{empty}
\setcounter{page}{0}
\cleardoublepage
}
%end{latexonly}

\tableofcontents
\listoffigures
\listoftables

\input{intro.tex}
\input{started_.tex}
\input{values_.tex}
\input{stmts_.tex}
\input{vars_.tex}
\input{predefined_.tex}
\input{analysis_.tex}
\input{todo_.tex}
\input{bib.tex}

% \appendix
% \input{grammar.tex}

\input{index.tex}
\printindex

\end{document}
