diff --git a/CHANGES b/CHANGES
index 76b16857b1..2897cbf9e9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,56 @@
 
+3.1.0-dev.542 | 2020-02-04 14:05:19 -0700
+
+  * UID, ..: un-inline methods to reduce header dependencies
+
+    Only 1% build time speedup, but still, it declutters the headers a bit.
+
+    Before this patch:
+
+     2565.17user 141.83system 2:25.46elapsed 1860%CPU (0avgtext+0avgdata 1489076maxresident)k
+     72576inputs+9130920outputs (1667major+49400430minor)pagefaults 0swaps
+
+    After this patch:
+
+     2537.19user 142.94system 2:26.90elapsed 1824%CPU (0avgtext+0avgdata 1434268maxresident)k
+     16240inputs+8887152outputs (1931major+48728888minor)pagefaults 0swaps (Max Kellermann)
+
+  * include cleanup
+
+    The Zeek code base has very inconsistent #includes.  Many sources
+    included a few headers, and those headers included other headers, and
+    in the end, nearly everything is included everywhere, so missing
+    #includes were never noticed.  Another side effect was a lot of header
+    bloat which slows down the build.
+
+    First step to fix it: in each source file, its own header should be
+    included first to verify that each header's includes are correct, and
+    none is missing.
+
+    After adding the missing #includes, I replaced lots of #includes
+    inside headers with class forward declarations.  In most headers,
+    object pointers are never referenced, so declaring the function
+    prototypes with forward-declared classes is just fine.
+
+    This patch speeds up the build by 19%, because each compilation unit
+    gets smaller.  Here are the "time" numbers for a fresh build (with a
+    warm page cache but without ccache):
+
+    Before this patch:
+
+     3144.94user 161.63system 3:02.87elapsed 1808%CPU (0avgtext+0avgdata 2168608maxresident)k
+     760inputs+12008400outputs (1511major+57747204minor)pagefaults 0swaps
+
+    After this patch:
+
+     2565.17user 141.83system 2:25.46elapsed 1860%CPU (0avgtext+0avgdata 1489076maxresident)k
+     72576inputs+9130920outputs (1667major+49400430minor)pagefaults 0swaps (Max Kellermann)
+
+  * Updating submodule(s).
+
+     [nomail] (Jon Siwek, Corelight)
+
+
 3.1.0-dev.538 | 2020-02-04 11:57:35 +0000
 
   * Updating submodules.
diff --git a/VERSION b/VERSION
index da2b7eefdf..a4c08e2210 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.1.0-dev.538
+3.1.0-dev.542
diff --git a/src/Anon.cc b/src/Anon.cc
index 6d2e7a6173..0c511ee158 100644
--- a/src/Anon.cc
+++ b/src/Anon.cc
@@ -1,3 +1,5 @@
+#include "Anon.h"
+
 #include <stdlib.h>
 #include <unistd.h>
 #include <assert.h>
@@ -5,9 +7,9 @@
 
 #include "util.h"
 #include "net_util.h"
-#include "Anon.h"
 #include "Val.h"
 #include "NetVar.h"
+#include "Reporter.h"
 
 
 AnonymizeIPAddr* ip_anonymizer[NUM_ADDR_ANONYMIZATION_METHODS] = {0};
@@ -66,6 +68,13 @@ ipaddr32_t AnonymizeIPAddr::Anonymize(ipaddr32_t addr)
 		}
 	}
 
+// Keep the specified prefix unchanged.
+int AnonymizeIPAddr::PreservePrefix(ipaddr32_t /* input */, int /* num_bits */)
+	{
+	reporter->InternalError("prefix preserving is not supported for the anonymizer");
+	return 0;
+	}
+
 int AnonymizeIPAddr::PreserveNet(ipaddr32_t input)
 	{
 	switch ( addr_to_class(ntohl(input)) ) {
diff --git a/src/Anon.h b/src/Anon.h
index f7cbaa24f3..6c3125f94c 100644
--- a/src/Anon.h
+++ b/src/Anon.h
@@ -11,11 +11,9 @@
 #pragma once
 
 #include <vector>
-#include <set>
 #include <map>
 
-#include "Reporter.h"
-#include "net_util.h"
+using std::map;
 
 // TODO: Anon.h may not be the right place to put these functions ...
 
@@ -46,12 +44,7 @@ public:
 
 	ipaddr32_t Anonymize(ipaddr32_t addr);
 
-	// Keep the specified prefix unchanged.
-	virtual int PreservePrefix(ipaddr32_t /* input */, int /* num_bits */)
-		{
-		reporter->InternalError("prefix preserving is not supported for the anonymizer");
-		return 0;
-		}
+	virtual int PreservePrefix(ipaddr32_t input, int num_bits);
 
 	virtual ipaddr32_t anonymize(ipaddr32_t addr) = 0;
 	
diff --git a/src/Attr.cc b/src/Attr.cc
index d63f72a3fd..c98af3586c 100644
--- a/src/Attr.cc
+++ b/src/Attr.cc
@@ -4,6 +4,8 @@
 
 #include "Attr.h"
 #include "Expr.h"
+#include "Desc.h"
+#include "Val.h"
 #include "threading/SerialTypes.h"
 
 const char* attr_name(attr_tag t)
diff --git a/src/Attr.h b/src/Attr.h
index 53d60eda27..9f8f6c90d2 100644
--- a/src/Attr.h
+++ b/src/Attr.h
@@ -3,6 +3,7 @@
 #pragma once
 
 #include "Obj.h"
+#include "BroList.h"
 
 class Expr;
 
diff --git a/src/Base64.cc b/src/Base64.cc
index 53ddfecef6..95e140e6c1 100644
--- a/src/Base64.cc
+++ b/src/Base64.cc
@@ -1,5 +1,9 @@
 #include "zeek-config.h"
 #include "Base64.h"
+#include "BroString.h"
+#include "Reporter.h"
+#include "Conn.h"
+
 #include <math.h>
 
 int Base64Converter::default_base64_table[256];
@@ -215,6 +219,14 @@ int Base64Converter::Done(int* pblen, char** pbuf)
 	return 0;
 	}
 
+void Base64Converter::IllegalEncoding(const char* msg)
+		{
+		// strncpy(error_msg, msg, sizeof(error_msg));
+		if ( conn )
+			conn->Weird("base64_illegal_encoding", msg);
+		else
+			reporter->Error("%s", msg);
+		}
 
 BroString* decode_base64(const BroString* s, const BroString* a, Connection* conn)
 	{
@@ -266,4 +278,3 @@ BroString* encode_base64(const BroString* s, const BroString* a, Connection* con
 
 	return new BroString(1, (u_char*)outbuf, outlen);
 	}
-
diff --git a/src/Base64.h b/src/Base64.h
index 8c8146c3c0..eaa6921c48 100644
--- a/src/Base64.h
+++ b/src/Base64.h
@@ -1,13 +1,11 @@
 #pragma once
 
-#include <assert.h>
-#include <stdio.h>
-#include <string.h>
+#include <string>
 
-#include "util.h"
-#include "BroString.h"
-#include "Reporter.h"
-#include "Conn.h"
+using std::string;
+
+class BroString;
+class Connection;
 
 // Maybe we should have a base class for generic decoders?
 class Base64Converter {
@@ -40,14 +38,7 @@ public:
 	int Errored() const	{ return errored; }
 
 	const char* ErrorMsg() const	{ return error_msg; }
-	void IllegalEncoding(const char* msg)
-		{
-		// strncpy(error_msg, msg, sizeof(error_msg));
-		if ( conn )
-			conn->Weird("base64_illegal_encoding", msg);
-		else
-			reporter->Error("%s", msg);
-		}
+	void IllegalEncoding(const char* msg);
 
 protected:
 	char error_msg[256];
diff --git a/src/BroString.cc b/src/BroString.cc
index 2938410a9f..ddd1b8093f 100644
--- a/src/BroString.cc
+++ b/src/BroString.cc
@@ -1,15 +1,16 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "BroString.h"
 
 #include <algorithm>
+#include <iostream>
 #include <ctype.h>
 
-#include <algorithm>
-
-#include "BroString.h"
+#include "Val.h"
 #include "Var.h"
 #include "Reporter.h"
+#include "util.h"
 
 #ifdef DEBUG
 #define DEBUG_STR(msg) DBG_LOG(DBG_STRING, msg)
@@ -274,6 +275,11 @@ void BroString::ToUpper()
 			b[i] = toupper(b[i]);
 	}
 
+unsigned int BroString::MemoryAllocation() const
+	{
+	return padded_sizeof(*this) + pad_size(n + final_NUL);
+	}
+
 BroString* BroString::GetSubstring(int start, int len) const
 	{
 	// This code used to live in zeek.bif's sub_bytes() routine.
diff --git a/src/BroString.h b/src/BroString.h
index 0361c0a927..40a1029291 100644
--- a/src/BroString.h
+++ b/src/BroString.h
@@ -4,11 +4,9 @@
 
 #include <vector>
 #include <string>
-#include <iostream>
-#include <stdlib.h>
-#include <sys/types.h>
+#include <iosfwd>
 
-#include "util.h"
+#include <sys/types.h>
 
 typedef u_char* byte_vec;
 
@@ -114,8 +112,7 @@ public:
 	// XXX and to_upper; the latter doesn't use BroString::ToUpper().
 	void ToUpper();
 
-	unsigned int MemoryAllocation() const
-		{ return padded_sizeof(*this) + pad_size(n + final_NUL); }
+	unsigned int MemoryAllocation() const;
 
 	// Returns new string containing the substring of this string,
 	// starting at @start >= 0 for going up to @length elements,
diff --git a/src/Brofiler.cc b/src/Brofiler.cc
index 5603040786..c406182747 100644
--- a/src/Brofiler.cc
+++ b/src/Brofiler.cc
@@ -1,3 +1,5 @@
+#include "Brofiler.h"
+
 #include <cstdio>
 #include <cstring>
 #include <sstream>
@@ -5,7 +7,10 @@
 #include <utility>
 #include <algorithm>
 #include <sys/stat.h>
-#include "Brofiler.h"
+
+#include "Stmt.h"
+#include "Desc.h"
+#include "Reporter.h"
 #include "util.h"
 
 Brofiler::Brofiler()
diff --git a/src/Brofiler.h b/src/Brofiler.h
index 504b6e324f..ee8d528baf 100644
--- a/src/Brofiler.h
+++ b/src/Brofiler.h
@@ -3,8 +3,14 @@
 #include <map>
 #include <utility>
 #include <list>
-#include <Stmt.h>
+#include <string>
 
+using std::list;
+using std::map;
+using std::pair;
+using std::string;
+
+class Stmt;
 
 /**
  * A simple class for managing stats of Bro script coverage across Bro runs.
diff --git a/src/CCL.cc b/src/CCL.cc
index 34809843ef..732d386163 100644
--- a/src/CCL.cc
+++ b/src/CCL.cc
@@ -43,3 +43,8 @@ void CCL::Sort()
 	{
 	std::sort(syms->begin(), syms->end());
 	}
+
+unsigned int CCL::MemoryAllocation() const
+	{
+	return padded_sizeof(*this) + padded_sizeof(*syms) + pad_size(syms->size() * sizeof(int_list::value_type));
+	}
diff --git a/src/CCL.h b/src/CCL.h
index 28f41e9922..58c04688d9 100644
--- a/src/CCL.h
+++ b/src/CCL.h
@@ -2,8 +2,9 @@
 
 #pragma once
 
+#include "util.h" // for ptr_compat_int
+
 #include <vector>
-#include "List.h"
 
 typedef std::vector<ptr_compat_int> int_list;
 
@@ -24,8 +25,7 @@ public:
 	void ReplaceSyms(int_list* new_syms)
 				{ delete syms; syms = new_syms; }
 
-	unsigned int MemoryAllocation() const
-		{ return padded_sizeof(*this) + padded_sizeof(*syms) + pad_size(syms->size() * sizeof(int_list::value_type)); }
+	unsigned int MemoryAllocation() const;
 
 protected:
 	int_list* syms;
diff --git a/src/CompHash.h b/src/CompHash.h
index 073d4b049f..ef0f0d14c3 100644
--- a/src/CompHash.h
+++ b/src/CompHash.h
@@ -2,10 +2,10 @@
 
 #pragma once
 
-#include "Hash.h"
 #include "Type.h"
 
 class ListVal;
+class HashKey;
 
 class CompositeHash {
 public:
diff --git a/src/Conn.cc b/src/Conn.cc
index 1f96af5a7d..650105ddd3 100644
--- a/src/Conn.cc
+++ b/src/Conn.cc
@@ -2,15 +2,18 @@
 
 #include "zeek-config.h"
 
+#include "Conn.h"
+
 #include <ctype.h>
 
+#include "Desc.h"
 #include "Net.h"
 #include "NetVar.h"
-#include "Conn.h"
 #include "Event.h"
 #include "Sessions.h"
 #include "Reporter.h"
 #include "Timer.h"
+#include "iosource/IOSource.h"
 #include "analyzer/protocol/pia/PIA.h"
 #include "binpac.h"
 #include "TunnelEncapsulation.h"
diff --git a/src/Conn.h b/src/Conn.h
index a7ea9d3820..562511d8b9 100644
--- a/src/Conn.h
+++ b/src/Conn.h
@@ -7,17 +7,15 @@
 #include <string>
 
 #include "Dict.h"
-#include "Val.h"
 #include "Timer.h"
-#include "RuleMatcher.h"
+#include "Rule.h"
 #include "IPAddr.h"
-#include "TunnelEncapsulation.h"
 #include "UID.h"
 #include "WeirdState.h"
+#include "iosource/Packet.h"
 
 #include "analyzer/Tag.h"
 #include "analyzer/Analyzer.h"
-#include "iosource/Packet.h"
 
 class Connection;
 class ConnectionTimer;
@@ -26,6 +24,9 @@ class LoginConn;
 class RuleHdrTest;
 class Specific_RE_Matcher;
 class RuleEndpointState;
+class EncapsulationStack;
+class Val;
+class RecordVal;
 
 namespace analyzer { class TransportLayerAnalyzer; }
 
diff --git a/src/DFA.cc b/src/DFA.cc
index 23aecbad60..e99e772fcc 100644
--- a/src/DFA.cc
+++ b/src/DFA.cc
@@ -2,8 +2,9 @@
 
 #include "zeek-config.h"
 
-#include "EquivClass.h"
 #include "DFA.h"
+#include "EquivClass.h"
+#include "Desc.h"
 #include "digest.h"
 
 unsigned int DFA_State::transition_counter = 0;
diff --git a/src/DFA.h b/src/DFA.h
index a3b79920f6..332cdaff8e 100644
--- a/src/DFA.h
+++ b/src/DFA.h
@@ -3,9 +3,15 @@
 
 #pragma once
 
-#include <assert.h>
+#include "RE.h" // for typedef AcceptingSet
+#include "Obj.h"
+
+#include <map>
 #include <string>
 
+#include <assert.h>
+#include <sys/types.h> // for u_char
+
 class DFA_State;
 
 // Transitions to the uncomputed state indicate that we haven't yet
diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc
index 93eba847cc..90b42db748 100644
--- a/src/DNS_Mgr.cc
+++ b/src/DNS_Mgr.cc
@@ -2,6 +2,8 @@
 
 #include "zeek-config.h"
 
+#include "DNS_Mgr.h"
+
 #include <sys/types.h>
 #include <sys/socket.h>
 #ifdef TIME_WITH_SYS_TIME
@@ -29,9 +31,9 @@
 
 #include <algorithm>
 
-#include "DNS_Mgr.h"
 #include "Event.h"
 #include "Net.h"
+#include "Val.h"
 #include "Var.h"
 #include "Reporter.h"
 #include "iosource/Manager.h"
diff --git a/src/DNS_Mgr.h b/src/DNS_Mgr.h
index 6b5975f876..3c816f1afb 100644
--- a/src/DNS_Mgr.h
+++ b/src/DNS_Mgr.h
@@ -7,9 +7,7 @@
 #include <queue>
 #include <utility>
 
-#include "util.h"
 #include "List.h"
-#include "Dict.h"
 #include "EventHandler.h"
 #include "iosource/IOSource.h"
 #include "IPAddr.h"
diff --git a/src/DbgBreakpoint.cc b/src/DbgBreakpoint.cc
index 50f5295fc5..2ca288ffa6 100644
--- a/src/DbgBreakpoint.cc
+++ b/src/DbgBreakpoint.cc
@@ -2,17 +2,22 @@
 
 #include "zeek-config.h"
 
+#include "DbgBreakpoint.h"
+
 #include <assert.h>
 
+#include "Desc.h"
 #include "ID.h"
 #include "Queue.h"
 #include "Debug.h"
 #include "Scope.h"
+#include "Frame.h"
 #include "Func.h"
+#include "Val.h"
 #include "Stmt.h"
-#include "DbgBreakpoint.h"
 #include "Timer.h"
-
+#include "Reporter.h"
+#include "module_util.h"
 
 // BreakpointTimer used for time-based breakpoints
 class BreakpointTimer : public Timer {
diff --git a/src/DbgBreakpoint.h b/src/DbgBreakpoint.h
index 6f762e3c00..be5d27d6dd 100644
--- a/src/DbgBreakpoint.h
+++ b/src/DbgBreakpoint.h
@@ -2,7 +2,12 @@
 
 #pragma once
 
-#include "Debug.h"
+#include <string>
+
+using std::string;
+
+struct ParseLocationRec;
+class Stmt;
 
 enum BreakCode { bcNoHit, bcHit, bcHitAndDelete };
 class DbgBreakpoint {
diff --git a/src/DbgDisplay.h b/src/DbgDisplay.h
index 2af0107261..cd159ad3af 100644
--- a/src/DbgDisplay.h
+++ b/src/DbgDisplay.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "Debug.h"
+class Expr;
 
 // Automatic displays: display these at each stoppage.
 class DbgDisplay {
diff --git a/src/DbgWatch.h b/src/DbgWatch.h
index fa96c083bc..2dfb8ea605 100644
--- a/src/DbgWatch.h
+++ b/src/DbgWatch.h
@@ -2,7 +2,8 @@
 
 #pragma once
 
-#include "Debug.h"
+class BroObj;
+class Expr;
 
 class DbgWatch {
 public:
diff --git a/src/Debug.cc b/src/Debug.cc
index 946fca7bd4..e0f6ca33f5 100644
--- a/src/Debug.cc
+++ b/src/Debug.cc
@@ -2,6 +2,8 @@
 
 #include "zeek-config.h"
 
+#include "Debug.h"
+
 #include <stdio.h>
 #include <stdarg.h>
 #include <signal.h>
@@ -11,13 +13,20 @@
 using namespace std;
 
 #include "util.h"
-#include "Debug.h"
 #include "DebugCmds.h"
 #include "DbgBreakpoint.h"
+#include "ID.h"
+#include "Expr.h"
 #include "Stmt.h"
+#include "Frame.h"
 #include "Func.h"
 #include "Scope.h"
 #include "PolicyFile.h"
+#include "Desc.h"
+#include "Reporter.h"
+#include "Val.h"
+#include "module_util.h"
+#include "input.h"
 
 #ifdef HAVE_READLINE
 #include <readline/readline.h>
diff --git a/src/Debug.h b/src/Debug.h
index 42fd3bd42a..45bb8ed470 100644
--- a/src/Debug.h
+++ b/src/Debug.h
@@ -2,10 +2,15 @@
 
 #pragma once
 
+#include "Obj.h"
+#include "Queue.h"
+#include "StmtEnums.h"
+
 #include <vector>
 #include <map>
 #include <string>
 
+class Val;
 class Stmt;
 
 // This needs to be defined before we do the includes that come after it.
@@ -17,17 +22,10 @@ struct ParseLocationRec {
 	int line;
 };
 
-#include "Expr.h"
-#include "Var.h"
-#include "Frame.h"
-#include "Queue.h"
-#include "Dict.h"
-#include "StmtEnums.h"
-#include "DbgBreakpoint.h"
-
 class StmtLocMapping;
 typedef PQueue<StmtLocMapping> Filemap; // mapping for a single file
 
+class Frame;
 class DbgBreakpoint;
 class DbgWatch;
 class DbgDisplay;
diff --git a/src/DebugCmds.cc b/src/DebugCmds.cc
index 6ae6a56f40..0632d24a9a 100644
--- a/src/DebugCmds.cc
+++ b/src/DebugCmds.cc
@@ -2,6 +2,7 @@
 // implementation of most commands.
 
 #include "zeek-config.h"
+#include "DebugCmds.h"
 
 #include <sys/types.h>
 
@@ -9,14 +10,18 @@
 #include <string.h>
 #include <assert.h>
 
-#include "Debug.h"
-#include "DebugCmds.h"
 #include "DebugCmdInfoConstants.cc"
+#include "Debug.h"
+#include "Desc.h"
 #include "DbgBreakpoint.h"
+#include "ID.h"
+#include "Frame.h"
 #include "Func.h"
 #include "Stmt.h"
 #include "Scope.h"
+#include "Reporter.h"
 #include "PolicyFile.h"
+#include "Val.h"
 #include "util.h"
 
 //
diff --git a/src/Desc.cc b/src/Desc.cc
index 7baddeab0a..4511f59614 100644
--- a/src/Desc.cc
+++ b/src/Desc.cc
@@ -1,15 +1,15 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "Desc.h"
 
 #include <stdlib.h>
+#include <string.h>
 #include <errno.h>
 #include <math.h>
 
-#include "Desc.h"
 #include "File.h"
 #include "Reporter.h"
-
 #include "ConvertUTF.h"
 
 #define DEFAULT_SIZE 128
diff --git a/src/Desc.h b/src/Desc.h
index ff59aba43c..99ccffea0f 100644
--- a/src/Desc.h
+++ b/src/Desc.h
@@ -2,12 +2,14 @@
 
 #pragma once
 
-#include <stdio.h>
+#include "BroString.h" // for byte_vec
+#include "util.h" // for bro_int_t
+
 #include <set>
 #include <utility>
 #include <string>
 
-#include "BroString.h"
+#include <sys/types.h> // for u_char
 
 typedef enum {
 	DESC_READABLE,
diff --git a/src/Discard.cc b/src/Discard.cc
index f84e901143..cb279ca580 100644
--- a/src/Discard.cc
+++ b/src/Discard.cc
@@ -1,13 +1,18 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <algorithm>
-
 #include "zeek-config.h"
 
-#include "Net.h"
-#include "Var.h"
 #include "Discard.h"
 
+#include <algorithm>
+
+#include "Net.h"
+#include "Func.h"
+#include "Var.h"
+#include "Val.h"
+#include "IP.h"
+#include "Reporter.h" // for InterpreterException
+
 Discarder::Discarder()
 	{
 	check_ip = internal_func("discarder_check_ip");
diff --git a/src/Discard.h b/src/Discard.h
index 28a041cf05..fb154dcf92 100644
--- a/src/Discard.h
+++ b/src/Discard.h
@@ -2,14 +2,14 @@
 
 #pragma once
 
-#include "IP.h"
-#include "Func.h"
+#include <sys/types.h> // for u_char
 
 struct ip;
 struct tcphdr;
 struct udphdr;
 struct icmp;
 
+class IP_Hdr;
 class Val;
 class RecordType;
 class Func;
diff --git a/src/EquivClass.cc b/src/EquivClass.cc
index 60cddbf486..c067137227 100644
--- a/src/EquivClass.cc
+++ b/src/EquivClass.cc
@@ -3,6 +3,7 @@
 #include "zeek-config.h"
 
 #include "EquivClass.h"
+#include "CCL.h"
 
 EquivClass::EquivClass(int arg_size)
 	{
diff --git a/src/EquivClass.h b/src/EquivClass.h
index 5441442002..8285a8d866 100644
--- a/src/EquivClass.h
+++ b/src/EquivClass.h
@@ -4,7 +4,7 @@
 
 #include <stdio.h>
 
-#include "CCL.h"
+class CCL;
 
 class EquivClass {
 public:
diff --git a/src/Event.cc b/src/Event.cc
index 8e8db10ed9..89fdd5d907 100644
--- a/src/Event.cc
+++ b/src/Event.cc
@@ -3,9 +3,11 @@
 #include "zeek-config.h"
 
 #include "Event.h"
+#include "Desc.h"
 #include "Func.h"
 #include "NetVar.h"
 #include "Trigger.h"
+#include "Val.h"
 #include "plugin/Manager.h"
 
 EventMgr mgr;
@@ -101,6 +103,19 @@ EventMgr::~EventMgr()
 	Unref(src_val);
 	}
 
+void EventMgr::QueueEvent(const EventHandlerPtr &h, val_list vl,
+			  SourceID src, analyzer::ID aid,
+			  TimerMgr* mgr, BroObj* obj)
+	{
+	if ( h )
+		QueueEvent(new Event(h, std::move(vl), src, aid, mgr, obj));
+	else
+		{
+		for ( const auto& v : vl )
+			Unref(v);
+		}
+	}
+
 void EventMgr::QueueEvent(Event* event)
 	{
 	bool done = PLUGIN_HOOK_WITH_RESULT(HOOK_QUEUE_EVENT, HookQueueEvent(event), false);
@@ -119,6 +134,13 @@ void EventMgr::QueueEvent(Event* event)
 	++num_events_queued;
 	}
 
+void EventMgr::Dispatch(Event* event, bool no_remote)
+	{
+	current_src = event->Source();
+	event->Dispatch(no_remote);
+	Unref(event);
+	}
+
 void EventMgr::Drain()
 	{
 	if ( event_queue_flush_point )
diff --git a/src/Event.h b/src/Event.h
index 411d48b011..1482ecb83e 100644
--- a/src/Event.h
+++ b/src/Event.h
@@ -2,9 +2,7 @@
 
 #pragma once
 
-#include "EventRegistry.h"
-
-#include "analyzer/Tag.h"
+#include "BroList.h"
 #include "analyzer/Analyzer.h"
 
 class EventMgr;
@@ -79,16 +77,7 @@ public:
 	// existence check.
 	void QueueEvent(const EventHandlerPtr &h, val_list vl,
 			SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0,
-			TimerMgr* mgr = 0, BroObj* obj = 0)
-		{
-		if ( h )
-			QueueEvent(new Event(h, std::move(vl), src, aid, mgr, obj));
-		else
-			{
-			for ( const auto& v : vl )
-				Unref(v);
-			}
-		}
+			TimerMgr* mgr = 0, BroObj* obj = 0);
 
 	// Same as QueueEvent, except taking the event's argument list via a
 	// pointer instead of by value.  This function takes ownership of the
@@ -102,12 +91,7 @@ public:
 		delete vl;
 		}
 
-	void Dispatch(Event* event, bool no_remote = false)
-		{
-		current_src = event->Source();
-		event->Dispatch(no_remote);
-		Unref(event);
-		}
+	void Dispatch(Event* event, bool no_remote = false);
 
 	void Drain();
 	bool IsDraining() const	{ return draining; }
diff --git a/src/EventHandler.cc b/src/EventHandler.cc
index 8c1b9f28f2..9928df9a8b 100644
--- a/src/EventHandler.cc
+++ b/src/EventHandler.cc
@@ -1,5 +1,6 @@
-#include "Event.h"
 #include "EventHandler.h"
+#include "Event.h"
+#include "Desc.h"
 #include "Func.h"
 #include "Scope.h"
 #include "NetVar.h"
diff --git a/src/EventHandler.h b/src/EventHandler.h
index 4978eb3064..ed01bf18a3 100644
--- a/src/EventHandler.h
+++ b/src/EventHandler.h
@@ -2,11 +2,10 @@
 
 #pragma once
 
-#include <assert.h>
+#include "BroList.h"
+
 #include <unordered_set>
 #include <string>
-#include "List.h"
-#include "BroList.h"
 
 class Func;
 class FuncType;
diff --git a/src/EventRegistry.cc b/src/EventRegistry.cc
index a7ad0636f4..957f90efe0 100644
--- a/src/EventRegistry.cc
+++ b/src/EventRegistry.cc
@@ -1,4 +1,5 @@
 #include "EventRegistry.h"
+#include "EventHandler.h"
 #include "RE.h"
 #include "Reporter.h"
 
diff --git a/src/EventRegistry.h b/src/EventRegistry.h
index a8c1eb1049..e49366e0d3 100644
--- a/src/EventRegistry.h
+++ b/src/EventRegistry.h
@@ -4,11 +4,14 @@
 
 #include <map>
 #include <string>
+#include <vector>
 
-#include "Func.h"
-#include "List.h"
-#include "Dict.h"
-#include "EventHandler.h"
+using std::string;
+using std::vector;
+
+class EventHandler;
+class EventHandlerPtr;
+class RE_Matcher;
 
 // The registry keeps track of all events that we provide or handle.
 class EventRegistry {
diff --git a/src/Expr.cc b/src/Expr.cc
index 1049f12929..9aff73cdb1 100644
--- a/src/Expr.cc
+++ b/src/Expr.cc
@@ -4,6 +4,7 @@
 
 #include "Expr.h"
 #include "Event.h"
+#include "Desc.h"
 #include "Frame.h"
 #include "Func.h"
 #include "RE.h"
@@ -15,6 +16,8 @@
 #include "Trigger.h"
 #include "IPAddr.h"
 #include "digest.h"
+#include "module_util.h"
+#include "DebugLogger.h"
 
 #include "broker/Data.h"
 
@@ -132,12 +135,32 @@ Val* Expr::InitVal(const BroType* t, Val* aggr) const
 	return check_and_promote(Eval(0), t, 1);
 	}
 
+int Expr::IsError() const
+	{
+	return type && type->Tag() == TYPE_ERROR;
+	}
+
+void Expr::SetError()
+	{
+	SetType(error_type());
+	}
+
 void Expr::SetError(const char* msg)
 	{
 	Error(msg);
 	SetError();
 	}
 
+int Expr::IsZero() const
+	{
+	return IsConst() && ExprVal()->IsZero();
+	}
+
+int Expr::IsOne() const
+	{
+	return IsConst() && ExprVal()->IsOne();
+	}
+
 void Expr::Describe(ODesc* d) const
 	{
 	if ( IsParen() && ! d->IsBinary() )
@@ -2076,6 +2099,11 @@ AssignExpr::AssignExpr(Expr* arg_op1, Expr* arg_op2, int arg_is_init,
 	SetLocationInfo(arg_op1->GetLocationInfo(), arg_op2->GetLocationInfo());
 	}
 
+AssignExpr::~AssignExpr()
+	{
+	Unref(val);
+	}
+
 bool AssignExpr::TypeCheck(attr_list* attrs)
 	{
 	TypeTag bt1 = op1->Type()->Tag();
diff --git a/src/Expr.h b/src/Expr.h
index 34aaec4847..701e826b19 100644
--- a/src/Expr.h
+++ b/src/Expr.h
@@ -5,16 +5,17 @@
 // BRO expressions.
 
 #include "BroList.h"
-#include "ID.h"
 #include "Timer.h"
-#include "Val.h"
-#include "Debug.h"
+#include "Type.h"
 #include "EventHandler.h"
 #include "TraverseTypes.h"
 
 #include <memory>
+#include <string>
 #include <utility>
 
+using std::string;
+
 typedef enum {
 	EXPR_ANY = -1,
 	EXPR_NAME, EXPR_CONST,
@@ -117,10 +118,10 @@ public:
 	int IsConst() const	{ return tag == EXPR_CONST; }
 
 	// True if the expression is in error (to alleviate error propagation).
-	int IsError() const	{ return type && type->Tag() == TYPE_ERROR; }
+	int IsError() const;
 
 	// Mark expression as in error.
-	void SetError()		{ SetType(error_type()); }
+	void SetError();
 	void SetError(const char* msg);
 
 	// Returns the expression's constant value, or complains
@@ -128,16 +129,10 @@ public:
 	inline Val* ExprVal() const;
 
 	// True if the expression is a constant zero, false otherwise.
-	int IsZero() const
-		{
-		return IsConst() && ExprVal()->IsZero();
-		}
+	int IsZero() const;
 
 	// True if the expression is a constant one, false otherwise.
-	int IsOne() const
-		{
-		return IsConst() && ExprVal()->IsOne();
-		}
+	int IsOne() const;
 
 	// True if the expression supports the "add" or "delete" operations,
 	// false otherwise.
@@ -603,7 +598,7 @@ public:
 	// If val is given, evaluating this expression will always yield the val
 	// yet still perform the assignment.  Used for triggers.
 	AssignExpr(Expr* op1, Expr* op2, int is_init, Val* val = 0, attr_list* attrs = 0);
-	~AssignExpr() override { Unref(val); }
+	~AssignExpr() override;
 
 	Val* Eval(Frame* f) const override;
 	void EvalIntoAggregate(const BroType* t, Val* aggr, Frame* f) const override;
@@ -873,8 +868,6 @@ protected:
 	int num_fields;
 };
 
-class EventHandler;
-
 class ScheduleTimer : public Timer {
 public:
 	ScheduleTimer(EventHandlerPtr event, val_list* args, double t,
diff --git a/src/File.cc b/src/File.cc
index 2a48f14ef9..14ced1d32c 100644
--- a/src/File.cc
+++ b/src/File.cc
@@ -1,6 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "File.h"
 
 #include <sys/types.h>
 #ifdef TIME_WITH_SYS_TIME
@@ -20,13 +21,14 @@
 
 #include <algorithm>
 
-#include "File.h"
+#include "Attr.h"
 #include "Type.h"
 #include "Expr.h"
 #include "NetVar.h"
 #include "Net.h"
 #include "Event.h"
 #include "Reporter.h"
+#include "Desc.h"
 
 std::list<std::pair<std::string, BroFile*>> BroFile::open_files;
 
diff --git a/src/File.h b/src/File.h
index 6433cd7dfd..c5a358a23a 100644
--- a/src/File.h
+++ b/src/File.h
@@ -2,19 +2,21 @@
 
 #pragma once
 
-#include <fcntl.h>
-#include "util.h"
 #include "Obj.h"
-#include "Attr.h"
 
 #include <list>
+#include <string>
 #include <utility>
 
+#include <fcntl.h>
+
 # ifdef NEED_KRB5_H
 #  include <krb5.h>
 # endif // NEED_KRB5_H
 
+class Attributes;
 class BroType;
+class RecordVal;
 
 class BroFile : public BroObj {
 public:
diff --git a/src/Frag.cc b/src/Frag.cc
index a39f2ea33e..c09ffe9834 100644
--- a/src/Frag.cc
+++ b/src/Frag.cc
@@ -2,11 +2,12 @@
 
 #include "zeek-config.h"
 
-#include "util.h"
-#include "Hash.h"
 #include "Frag.h"
+#include "Hash.h"
+#include "IP.h"
 #include "NetVar.h"
 #include "Sessions.h"
+#include "Reporter.h"
 
 #define MIN_ACCEPTABLE_FRAG_SIZE 64
 #define MAX_ACCEPTABLE_FRAG_SIZE 64000
diff --git a/src/Frag.h b/src/Frag.h
index 1c5d83d89b..2a8b21db6c 100644
--- a/src/Frag.h
+++ b/src/Frag.h
@@ -2,16 +2,18 @@
 
 #pragma once
 
-#include <tuple>
-
-#include "util.h"
-#include "IP.h"
-#include "Net.h"
+#include "util.h" // for bro_uint_t
+#include "IPAddr.h"
 #include "Reassem.h"
 #include "Timer.h"
 
+#include <tuple>
+
+#include <sys/types.h> // for u_char
+
 class HashKey;
 class NetSessions;
+class IP_Hdr;
 
 class FragReassembler;
 class FragTimer;
diff --git a/src/Frame.cc b/src/Frame.cc
index 369e28db47..e6b42ddd04 100644
--- a/src/Frame.cc
+++ b/src/Frame.cc
@@ -1,10 +1,15 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "Frame.h"
+
 #include <broker/error.hh>
 #include "broker/Data.h"
 
-#include "Frame.h"
+#include "Func.h"
+#include "Desc.h"
+#include "IntrusivePtr.h"
 #include "Trigger.h"
+#include "Val.h"
 
 vector<Frame*> g_frame_stack;
 
@@ -531,6 +536,14 @@ void Frame::ClearTrigger()
 	trigger = nullptr;
 	}
 
+void Frame::UnrefElement(int n)
+	{
+	if ( weak_refs && weak_refs[n] )
+		return;
+
+	Unref(frame[n]);
+	}
+
 bool Frame::IsOuterID(const ID* in) const
 	{
 	return std::any_of(outer_ids.begin(), outer_ids.end(),
diff --git a/src/Frame.h b/src/Frame.h
index 21f411ba1f..8e9cbdc4e7 100644
--- a/src/Frame.h
+++ b/src/Frame.h
@@ -2,17 +2,20 @@
 
 #pragma once
 
+#include "BroList.h" // for typedef val_list
+#include "Obj.h"
+
 #include <unordered_map>
-#include <memory>
 #include <string>
+#include <utility>
+#include <vector>
 
 #include <broker/data.hh>
 #include <broker/expected.hh>
 
-#include "Val.h"
-
 namespace trigger { class Trigger; }
 class CallExpr;
+class BroFunc;
 
 class Frame :  public BroObj {
 public:
@@ -232,13 +235,7 @@ private:
 	/**
 	 * Unrefs the value at offset 'n' frame unless it's a weak reference.
 	 */
-	void UnrefElement(int n)
-		{
-		if ( weak_refs && weak_refs[n] )
-			return;
-
-		Unref(frame[n]);
-		}
+	void UnrefElement(int n);
 
 	/** Have we captured this id? */
 	bool IsOuterID(const ID* in) const;
diff --git a/src/Func.cc b/src/Func.cc
index e0f4958660..759b132a9a 100644
--- a/src/Func.cc
+++ b/src/Func.cc
@@ -1,6 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "Func.h"
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -32,12 +33,14 @@
 #include <broker/error.hh>
 
 #include "Base64.h"
+#include "Debug.h"
+#include "Desc.h"
+#include "Expr.h"
 #include "Stmt.h"
 #include "Scope.h"
 #include "Net.h"
 #include "NetVar.h"
 #include "File.h"
-#include "Func.h"
 #include "Frame.h"
 #include "Var.h"
 #include "analyzer/protocol/login/Login.h"
@@ -47,6 +50,9 @@
 #include "Traverse.h"
 #include "Reporter.h"
 #include "plugin/Manager.h"
+#include "module_util.h"
+#include "iosource/PktSrc.h"
+#include "iosource/PktDumper.h"
 
 extern	RETSIGTYPE sig_handler(int signo);
 
diff --git a/src/Func.h b/src/Func.h
index 802c4509da..e70980d1de 100644
--- a/src/Func.h
+++ b/src/Func.h
@@ -2,16 +2,21 @@
 
 #pragma once
 
+#include "BroList.h"
+#include "Obj.h"
+#include "Type.h" /* for function_flavor */
+#include "TraverseTypes.h"
+
 #include <utility>
 #include <memory>
+#include <string>
+#include <vector>
 
 #include <broker/data.hh>
 #include <broker/expected.hh>
 
-#include "BroList.h"
-#include "Obj.h"
-#include "Debug.h"
-#include "Frame.h"
+using std::string;
+using std::vector;
 
 class Val;
 class ListExpr;
@@ -20,6 +25,7 @@ class Stmt;
 class Frame;
 class ID;
 class CallExpr;
+class Scope;
 
 class Func : public BroObj {
 public:
diff --git a/src/Hash.cc b/src/Hash.cc
index 57ef6659b9..c20e928dd5 100644
--- a/src/Hash.cc
+++ b/src/Hash.cc
@@ -19,6 +19,7 @@
 
 #include "Hash.h"
 #include "Reporter.h"
+#include "BroString.h"
 
 #include "siphash24.h"
 
diff --git a/src/Hash.h b/src/Hash.h
index 0a5655f049..9a5c99c60e 100644
--- a/src/Hash.h
+++ b/src/Hash.h
@@ -2,12 +2,14 @@
 
 #pragma once
 
+#include "util.h" // for bro_int_t
+
 #include <stdlib.h>
 
-#include "BroString.h"
-
 #define UHASH_KEY_SIZE 36
 
+class BroString;
+
 typedef uint64_t hash_t;
 
 typedef enum {
diff --git a/src/ID.cc b/src/ID.cc
index 6029cb9862..d6b949fc59 100644
--- a/src/ID.cc
+++ b/src/ID.cc
@@ -3,15 +3,22 @@
 #include "zeek-config.h"
 
 #include "ID.h"
+#include "Attr.h"
+#include "Desc.h"
 #include "Expr.h"
 #include "Dict.h"
 #include "EventRegistry.h"
 #include "Func.h"
 #include "Scope.h"
+#include "Type.h"
 #include "File.h"
 #include "Scope.h"
 #include "Traverse.h"
+#include "Val.h"
 #include "zeekygen/Manager.h"
+#include "zeekygen/IdentifierInfo.h"
+#include "zeekygen/ScriptInfo.h"
+#include "module_util.h"
 
 ID::ID(const char* arg_name, IDScope arg_scope, bool arg_is_export)
 	{
@@ -51,6 +58,11 @@ string ID::ModuleName() const
 	return extract_module_name(name);
 	}
 
+void ID::SetType(BroType* t)
+	{
+	Unref(type); type = t;
+	}
+
 void ID::ClearVal()
 	{
 	if ( ! weak_ref )
@@ -143,6 +155,11 @@ void ID::SetVal(Expr* ev, init_class c)
 	EvalFunc(a->AttrExpr(), ev);
 	}
 
+bool ID::IsRedefinable() const
+	{
+	return FindAttr(ATTR_REDEF) != 0;
+	}
+
 void ID::SetAttrs(Attributes* a)
 	{
 	Unref(attrs);
@@ -189,6 +206,16 @@ void ID::UpdateValAttrs()
 		}
 	}
 
+Attr* ID::FindAttr(attr_tag t) const
+	{
+	return attrs ? attrs->FindAttr(t) : 0;
+	}
+
+bool ID::IsDeprecated() const
+	{
+	return FindAttr(ATTR_DEPRECATED) != 0;
+	}
+
 void ID::MakeDeprecated(Expr* deprecation)
 	{
 	if ( IsDeprecated() )
diff --git a/src/ID.h b/src/ID.h
index b3e36ebd4f..7b6a1ada6c 100644
--- a/src/ID.h
+++ b/src/ID.h
@@ -2,14 +2,20 @@
 
 #pragma once
 
-#include "Type.h"
+#include "Obj.h"
 #include "Attr.h"
 #include "Notifier.h"
 #include "TraverseTypes.h"
+
+#include <map>
 #include <string>
+#include <vector>
 
 class Val;
+class Expr;
 class Func;
+class BroType;
+class Attributes;
 
 typedef enum { INIT_NONE, INIT_FULL, INIT_EXTRA, INIT_REMOVE, } init_class;
 typedef enum { SCOPE_FUNCTION, SCOPE_MODULE, SCOPE_GLOBAL } IDScope;
@@ -29,7 +35,7 @@ public:
 
 	std::string ModuleName() const;
 
-	void SetType(BroType* t)	{ Unref(type); type = t; }
+	void SetType(BroType* t);
 	BroType* Type()			{ return type; }
 	const BroType* Type() const	{ return type; }
 
@@ -67,7 +73,7 @@ public:
 	void SetOffset(int arg_offset)	{ offset = arg_offset; }
 	int Offset() const		{ return offset; }
 
-	bool IsRedefinable() const	{ return FindAttr(ATTR_REDEF) != 0; }
+	bool IsRedefinable() const;
 
 	void SetAttrs(Attributes* attr);
 	void AddAttrs(Attributes* attr);
@@ -75,11 +81,9 @@ public:
 	void UpdateValAttrs();
 	Attributes* Attrs() const	{ return attrs; }
 
-	Attr* FindAttr(attr_tag t) const
-		{ return attrs ? attrs->FindAttr(t) : 0; }
+	Attr* FindAttr(attr_tag t) const;
 
-	bool IsDeprecated() const
-		{ return FindAttr(ATTR_DEPRECATED) != 0; }
+	bool IsDeprecated() const;
 
 	void MakeDeprecated(Expr* deprecation);
 
diff --git a/src/IP.cc b/src/IP.cc
index 2d220bae23..24ffac2b17 100644
--- a/src/IP.cc
+++ b/src/IP.cc
@@ -1,13 +1,16 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "IP.h"
+
 #include <sys/types.h>
 #include <netinet/in.h>
 #include <netinet/icmp6.h>
 
-#include "IP.h"
+#include "IPAddr.h"
 #include "Type.h"
 #include "Val.h"
 #include "Var.h"
+#include "Reporter.h"
 
 static RecordType* ip4_hdr_type = 0;
 static RecordType* ip6_hdr_type = 0;
@@ -304,6 +307,26 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 	return rv;
 	}
 
+IPAddr IP_Hdr::IPHeaderSrcAddr() const
+	{
+	return ip4 ? IPAddr(ip4->ip_src) : IPAddr(ip6->ip6_src);
+	}
+
+IPAddr IP_Hdr::IPHeaderDstAddr() const
+	{
+	return ip4 ? IPAddr(ip4->ip_dst) : IPAddr(ip6->ip6_dst);
+	}
+
+IPAddr IP_Hdr::SrcAddr() const
+	{
+	return ip4 ? IPAddr(ip4->ip_src) : ip6_hdrs->SrcAddr();
+	}
+
+IPAddr IP_Hdr::DstAddr() const
+	{
+	return ip4 ? IPAddr(ip4->ip_dst) : ip6_hdrs->DstAddr();
+	}
+
 RecordVal* IP_Hdr::BuildIPHdrVal() const
 	{
 	RecordVal* rval = 0;
@@ -446,6 +469,15 @@ static inline bool isIPv6ExtHeader(uint8_t type)
 	}
 	}
 
+IPv6_Hdr_Chain::~IPv6_Hdr_Chain()
+	{
+	for ( size_t i = 0; i < chain.size(); ++i ) delete chain[i];
+#ifdef ENABLE_MOBILE_IPV6
+	delete homeAddr;
+#endif
+	delete finalDst;
+	}
+
 void IPv6_Hdr_Chain::Init(const struct ip6_hdr* ip6, int total_len,
                           bool set_next, uint16_t next)
 	{
@@ -510,6 +542,46 @@ void IPv6_Hdr_Chain::Init(const struct ip6_hdr* ip6, int total_len,
 				  isIPv6ExtHeader(next_type) );
 	}
 
+bool IPv6_Hdr_Chain::IsFragment() const
+	{
+	if ( chain.empty() )
+		{
+		reporter->InternalWarning("empty IPv6 header chain");
+		return false;
+		}
+
+	return chain[chain.size()-1]->Type() == IPPROTO_FRAGMENT;
+	}
+
+IPAddr IPv6_Hdr_Chain::SrcAddr() const
+	{
+#ifdef ENABLE_MOBILE_IPV6
+	if ( homeAddr )
+		return IPAddr(*homeAddr);
+#endif
+	if ( chain.empty() )
+		{
+		reporter->InternalWarning("empty IPv6 header chain");
+		return IPAddr();
+		}
+
+	return IPAddr(((const struct ip6_hdr*)(chain[0]->Data()))->ip6_src);
+	}
+
+IPAddr IPv6_Hdr_Chain::DstAddr() const
+	{
+	if ( finalDst )
+		return IPAddr(*finalDst);
+
+	if ( chain.empty() )
+		{
+		reporter->InternalWarning("empty IPv6 header chain");
+		return IPAddr();
+		}
+
+	return IPAddr(((const struct ip6_hdr*)(chain[0]->Data()))->ip6_dst);
+	}
+
 void IPv6_Hdr_Chain::ProcessRoutingHeader(const struct ip6_rthdr* r, uint16_t len)
 	{
 	if ( finalDst )
diff --git a/src/IP.h b/src/IP.h
index a6017fdd30..9067e45c43 100644
--- a/src/IP.h
+++ b/src/IP.h
@@ -3,15 +3,23 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "net_util.h"
-#include "IPAddr.h"
-#include "Reporter.h"
-#include "Val.h"
-#include "Type.h"
+
 #include <vector>
+
+#include <sys/types.h> // for u_char
 #include <netinet/in.h>
 #include <netinet/ip.h>
 
+#ifdef HAVE_NETINET_IP6_H
+#include <netinet/ip6.h>
+#endif
+
+using std::vector;
+
+class IPAddr;
+class RecordVal;
+class VectorVal;
+
 #ifdef ENABLE_MOBILE_IPV6
 
 #ifndef IPPROTO_MOBILITY
@@ -147,14 +155,7 @@ public:
 		finalDst(0)
 		{ Init(ip6, len, false); }
 
-	~IPv6_Hdr_Chain()
-		{
-		for ( size_t i = 0; i < chain.size(); ++i ) delete chain[i];
-#ifdef ENABLE_MOBILE_IPV6
-		delete homeAddr;
-#endif
-		delete finalDst;
-		}
+	~IPv6_Hdr_Chain();
 
 	/**
 	 * @return a copy of the header chain, but with pointers to individual
@@ -180,16 +181,7 @@ public:
 	/**
 	 * Returns whether the header chain indicates a fragmented packet.
 	 */
-	bool IsFragment() const
-		{
-		if ( chain.empty() )
-			{
-			reporter->InternalWarning("empty IPv6 header chain");
-			return false;
-			}
-
-		return chain[chain.size()-1]->Type() == IPPROTO_FRAGMENT;
-		}
+	bool IsFragment() const;
 
 	/**
 	 * Returns pointer to fragment header structure if the chain contains one.
@@ -224,39 +216,14 @@ public:
 	 * option as defined by Mobile IPv6 (RFC 6275), then return it, else
 	 * return the source address in the main IPv6 header.
 	 */
-	IPAddr SrcAddr() const
-		{
-#ifdef ENABLE_MOBILE_IPV6
-		if ( homeAddr )
-			return IPAddr(*homeAddr);
-#endif
-		if ( chain.empty() )
-			{
-			reporter->InternalWarning("empty IPv6 header chain");
-			return IPAddr();
-			}
-
-		return IPAddr(((const struct ip6_hdr*)(chain[0]->Data()))->ip6_src);
-		}
+	IPAddr SrcAddr() const;
 
 	/**
 	 * If the chain contains a Routing header with non-zero segments left,
 	 * then return the last address of the first such header, else return
 	 * the destination address of the main IPv6 header.
 	 */
-	IPAddr DstAddr() const
-		{
-		if ( finalDst )
-			return IPAddr(*finalDst);
-
-		if ( chain.empty() )
-			{
-			reporter->InternalWarning("empty IPv6 header chain");
-			return IPAddr();
-			}
-
-		return IPAddr(((const struct ip6_hdr*)(chain[0]->Data()))->ip6_dst);
-		}
+	IPAddr DstAddr() const;
 
 	/**
 	 * Returns a vector of ip6_ext_hdr RecordVals that includes script-layer
@@ -400,22 +367,19 @@ public:
 	/**
 	 * Returns the source address held in the IP header.
 	 */
-	IPAddr IPHeaderSrcAddr() const
-		{ return ip4 ? IPAddr(ip4->ip_src) : IPAddr(ip6->ip6_src); }
+	IPAddr IPHeaderSrcAddr() const;
 
 	/**
 	 * Returns the destination address held in the IP header.
 	 */
-	IPAddr IPHeaderDstAddr() const
-		{ return ip4 ? IPAddr(ip4->ip_dst) : IPAddr(ip6->ip6_dst); }
+	IPAddr IPHeaderDstAddr() const;
 
 	/**
 	 * For IPv4 or IPv6 headers that don't contain a Home Address option
 	 * (Mobile IPv6, RFC 6275), return source address held in the IP header.
 	 * For IPv6 headers that contain a Home Address option, return that address.
 	 */
-	IPAddr SrcAddr() const
-		{ return ip4 ? IPAddr(ip4->ip_src) : ip6_hdrs->SrcAddr(); }
+	IPAddr SrcAddr() const;
 
 	/**
 	 * For IPv4 or IPv6 headers that don't contain a Routing header with
@@ -423,8 +387,7 @@ public:
 	 * For IPv6 headers with a Routing header that has non-zero segments left,
 	 * return the last address in the first such Routing header.
 	 */
-	IPAddr DstAddr() const
-		{ return ip4 ? IPAddr(ip4->ip_dst) : ip6_hdrs->DstAddr(); }
+	IPAddr DstAddr() const;
 
 	/**
 	 * Returns a pointer to the payload of the IP packet, usually an
diff --git a/src/IPAddr.cc b/src/IPAddr.cc
index 405d8b335a..cbcb8dc867 100644
--- a/src/IPAddr.cc
+++ b/src/IPAddr.cc
@@ -5,7 +5,9 @@
 #include <vector>
 #include "IPAddr.h"
 #include "Reporter.h"
+#include "BroString.h"
 #include "Conn.h"
+#include "Hash.h"
 #include "bro_inet_ntop.h"
 
 #include "analyzer/Manager.h"
@@ -45,6 +47,16 @@ ConnIDKey BuildConnIDKey(const ConnID& id)
 	return key;
 	}
 
+IPAddr::IPAddr(const BroString& s)
+	{
+	Init(s.CheckString());
+	}
+
+HashKey* IPAddr::GetHashKey() const
+	{
+	return new HashKey((void*)in6.s6_addr, sizeof(in6.s6_addr));
+	}
+
 static inline uint32_t bit_mask32(int bottom_bits)
 	{
 	if ( bottom_bits >= 32 )
@@ -290,6 +302,19 @@ string IPPrefix::AsString() const
 	return prefix.AsString() +"/" + l;
 	}
 
+HashKey* IPPrefix::GetHashKey() const
+	{
+	struct {
+		in6_addr ip;
+		uint32_t len;
+	} key;
+
+	key.ip = prefix.in6;
+	key.len = Length();
+
+	return new HashKey(&key, sizeof(key));
+	}
+
 bool IPPrefix::ConvertString(const char* text, IPPrefix* result)
 	{
 	string s(text);
diff --git a/src/IPAddr.h b/src/IPAddr.h
index a834fec851..04ecf5e33e 100644
--- a/src/IPAddr.h
+++ b/src/IPAddr.h
@@ -2,18 +2,17 @@
 
 #pragma once
 
+#include "threading/SerialTypes.h"
+
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <string.h>
 #include <string>
 
-#include "BroString.h"
-#include "Hash.h"
-#include "util.h"
-#include "Type.h"
-#include "threading/SerialTypes.h"
-
+using std::string;
 struct ConnID;
+class BroString;
+class HashKey;
 namespace analyzer { class ExpectedConn; }
 
 typedef in_addr in4_addr;
@@ -113,10 +112,7 @@ public:
 	 * @param s String containing an IP address as either a dotted IPv4
 	 * address or a hex IPv6 address.
 	 */
-	explicit IPAddr(const BroString& s)
-		{
-		Init(s.CheckString());
-		}
+	explicit IPAddr(const BroString& s);
 
 	/**
 	 * Constructs an address instance from a raw byte representation.
@@ -255,10 +251,7 @@ public:
 	 * Returns a key that can be used to lookup the IP Address in a hash
 	 * table. Passes ownership to caller.
 	 */
-	HashKey* GetHashKey() const
-		{
-		return new HashKey((void*)in6.s6_addr, sizeof(in6.s6_addr));
-		}
+	HashKey* GetHashKey() const;
 
 	/**
 	 * Masks out lower bits of the address.
@@ -640,18 +633,7 @@ public:
 	 * Returns a key that can be used to lookup the IP Prefix in a hash
 	 * table. Passes ownership to caller.
 	 */
-	HashKey* GetHashKey() const
-		{
-		struct {
-			in6_addr ip;
-			uint32_t len;
-		} key;
-
-		key.ip = prefix.in6;
-		key.len = Length();
-
-		return new HashKey(&key, sizeof(key));
-		}
+	HashKey* GetHashKey() const;
 
 	/** Converts the prefix into the type used internally by the
 	  * inter-thread communication.
diff --git a/src/NFA.cc b/src/NFA.cc
index 55fdb09439..f22b4e0b21 100644
--- a/src/NFA.cc
+++ b/src/NFA.cc
@@ -2,10 +2,12 @@
 
 #include "zeek-config.h"
 
-#include <algorithm>
-
 #include "NFA.h"
+#include "Desc.h"
 #include "EquivClass.h"
+#include "IntSet.h"
+
+#include <algorithm>
 
 static int nfa_state_id = 0;
 
diff --git a/src/NFA.h b/src/NFA.h
index 2982323afe..6b6827acc2 100644
--- a/src/NFA.h
+++ b/src/NFA.h
@@ -2,9 +2,11 @@
 
 #pragma once
 
-#include "RE.h"
-#include "IntSet.h"
+#include "Obj.h"
+#include "List.h"
 
+class CCL;
+class Func;
 class NFA_State;
 class EquivClass;
 
diff --git a/src/Net.cc b/src/Net.cc
index 77b7ad01fc..1b35907a93 100644
--- a/src/Net.cc
+++ b/src/Net.cc
@@ -1,6 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "Net.h"
 
 #include <sys/types.h>
 #ifdef TIME_WITH_SYS_TIME
@@ -19,13 +20,16 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+extern "C" {
+#include "setsignal.h"
+};
+
 #include "NetVar.h"
 #include "Sessions.h"
 #include "Event.h"
 #include "Timer.h"
 #include "Var.h"
 #include "Reporter.h"
-#include "Net.h"
 #include "Anon.h"
 #include "PacketDumper.h"
 #include "iosource/Manager.h"
@@ -34,10 +38,6 @@
 #include "plugin/Manager.h"
 #include "broker/Manager.h"
 
-extern "C" {
-#include "setsignal.h"
-};
-
 extern "C" {
 extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
 }
diff --git a/src/Net.h b/src/Net.h
index 655bab8c8e..25901a78dd 100644
--- a/src/Net.h
+++ b/src/Net.h
@@ -2,14 +2,14 @@
 
 #pragma once
 
+#include <list>
 #include <vector>
 #include <string>
 #include <optional>
 
-#include "net_util.h"
-#include "util.h"
-#include "List.h"
-#include "Func.h"
+#include <sys/stat.h> // for ino_t
+
+using std::string;
 
 namespace iosource {
 	class IOSource;
diff --git a/src/NetVar.cc b/src/NetVar.cc
index c3f8b34340..53a5e6c35c 100644
--- a/src/NetVar.cc
+++ b/src/NetVar.cc
@@ -2,8 +2,10 @@
 
 #include "zeek-config.h"
 
-#include "Var.h"
 #include "NetVar.h"
+#include "Var.h"
+#include "EventHandler.h"
+#include "Val.h"
 
 RecordType* conn_id;
 RecordType* endpoint;
diff --git a/src/Notifier.cc b/src/Notifier.cc
index 265c574b2a..0acd7e6cec 100644
--- a/src/Notifier.cc
+++ b/src/Notifier.cc
@@ -1,7 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "DebugLogger.h"
 #include "Notifier.h"
+#include "DebugLogger.h"
+
+#include <set>
 
 notifier::Registry notifier::registry;
 
diff --git a/src/Notifier.h b/src/Notifier.h
index e85345fa81..a3ae5188b7 100644
--- a/src/Notifier.h
+++ b/src/Notifier.h
@@ -7,12 +7,7 @@
 
 #pragma once
 
-#include <set>
 #include <unordered_map>
-#include <string>
-
-#include "util.h"
-#include "DebugLogger.h"
 
 namespace notifier  {
 
diff --git a/src/Obj.cc b/src/Obj.cc
index c2e47f50b8..91a9349d46 100644
--- a/src/Obj.cc
+++ b/src/Obj.cc
@@ -1,10 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "Obj.h"
 
 #include <stdlib.h>
 
-#include "Obj.h"
+#include "Desc.h"
 #include "Func.h"
 #include "File.h"
 #include "plugin/Manager.h"
diff --git a/src/Obj.h b/src/Obj.h
index 0147a21a8b..0c96013620 100644
--- a/src/Obj.h
+++ b/src/Obj.h
@@ -4,8 +4,7 @@
 
 #include <limits.h>
 
-#include "input.h"
-#include "Desc.h"
+class ODesc;
 
 class Location {
 public:
diff --git a/src/OpaqueVal.cc b/src/OpaqueVal.cc
index 033c4e6fe6..b522539469 100644
--- a/src/OpaqueVal.cc
+++ b/src/OpaqueVal.cc
@@ -5,9 +5,12 @@
 #include "OpaqueVal.h"
 #include "NetVar.h"
 #include "Reporter.h"
+#include "Desc.h"
+#include "Var.h"
 #include "probabilistic/BloomFilter.h"
 #include "probabilistic/CardinalityCounter.h"
 
+#include <broker/data.hh>
 #include <broker/error.hh>
 
 // Helper to retrieve a broker value out of a broker::vector at a specified
diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h
index faff969cbf..7d216e7ff9 100644
--- a/src/OpaqueVal.h
+++ b/src/OpaqueVal.h
@@ -2,14 +2,16 @@
 
 #pragma once
 
-#include <broker/data.hh>
-#include <broker/expected.hh>
-
 #include "RandTest.h"
 #include "Val.h"
 #include "digest.h"
 #include "paraglob/paraglob.h"
 
+#include <broker/expected.hh>
+
+#include <sys/types.h> // for u_char
+
+namespace broker { class data; }
 class OpaqueVal;
 
 /**
diff --git a/src/Options.cc b/src/Options.cc
index 27fc648ce3..c4f864189a 100644
--- a/src/Options.cc
+++ b/src/Options.cc
@@ -1,9 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <unistd.h>
-
 #include "zeek-config.h"
 
+#include "Options.h"
+
+#include <algorithm>
+
+#include <unistd.h>
+
 #ifdef HAVE_GETOPT_H
 #include <getopt.h>
 #endif
@@ -11,8 +15,6 @@
 #include "bsd-getopt-long.h"
 #include "logging/writers/ascii/Ascii.h"
 
-#include "Options.h"
-
 void zeek::Options::filter_supervisor_options()
 	{
 	pcap_filter = {};
diff --git a/src/PacketDumper.cc b/src/PacketDumper.cc
index 0d64c89290..ffb2a037d9 100644
--- a/src/PacketDumper.cc
+++ b/src/PacketDumper.cc
@@ -1,14 +1,10 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-
 #include "zeek-config.h"
-
-#include <assert.h>
-#include <stdlib.h>
-
-#include "Event.h"
-#include "Net.h"
 #include "PacketDumper.h"
+#include "Reporter.h"
+#include "util.h"
+#include "iosource/PktDumper.h"
 
 PacketDumper::PacketDumper(pcap_dumper_t* arg_pkt_dump)
 	{
diff --git a/src/PacketDumper.h b/src/PacketDumper.h
index 38a31b920d..421985150e 100644
--- a/src/PacketDumper.h
+++ b/src/PacketDumper.h
@@ -4,6 +4,8 @@
 
 #include <pcap.h>
 
+#include <sys/types.h> // for u_char
+
 class PacketDumper {
 public:
 	explicit PacketDumper(pcap_dumper_t* pkt_dump);
diff --git a/src/PacketFilter.cc b/src/PacketFilter.cc
index f506d1778e..480326d070 100644
--- a/src/PacketFilter.cc
+++ b/src/PacketFilter.cc
@@ -1,4 +1,5 @@
 #include "PacketFilter.h"
+#include "IP.h"
 
 void PacketFilter::DeleteFilter(void* data)
 	{
diff --git a/src/PacketFilter.h b/src/PacketFilter.h
index 384ce503c5..4729a4cd5e 100644
--- a/src/PacketFilter.h
+++ b/src/PacketFilter.h
@@ -2,9 +2,12 @@
 
 #pragma once
 
-#include "IP.h"
+#include "IPAddr.h"
 #include "PrefixTable.h"
 
+class IP_Hdr;
+class Val;
+
 class PacketFilter {
 public:
 	explicit PacketFilter(bool arg_default);
diff --git a/src/PrefixTable.cc b/src/PrefixTable.cc
index 007e08349c..ee2280757a 100644
--- a/src/PrefixTable.cc
+++ b/src/PrefixTable.cc
@@ -1,5 +1,6 @@
 #include "PrefixTable.h"
 #include "Reporter.h"
+#include "Val.h"
 
 prefix_t* PrefixTable::MakePrefix(const IPAddr& addr, int width)
 	{
diff --git a/src/PrefixTable.h b/src/PrefixTable.h
index e22a89fff8..21b956756a 100644
--- a/src/PrefixTable.h
+++ b/src/PrefixTable.h
@@ -1,13 +1,19 @@
 #pragma once
 
-#include "Val.h"
-#include "net_util.h"
 #include "IPAddr.h"
 
 extern "C" {
 	#include "patricia.h"
 }
 
+#include <list>
+
+using std::list;
+using std::tuple;
+
+class Val;
+class SubNetVal;
+
 class PrefixTable {
 private:
 	struct iterator {
diff --git a/src/PriorityQueue.h b/src/PriorityQueue.h
index 0368396836..665a83aa07 100644
--- a/src/PriorityQueue.h
+++ b/src/PriorityQueue.h
@@ -3,7 +3,7 @@
 #pragma once
 
 #include <math.h>
-#include "util.h"
+#include <stdint.h>
 
 class PriorityQueue;
 
diff --git a/src/Queue.h b/src/Queue.h
index 72adbd572a..1e5447ef27 100644
--- a/src/Queue.h
+++ b/src/Queue.h
@@ -2,6 +2,8 @@
 
 #pragma once
 
+#include <iterator>
+
 // Queue.h --
 //	Interface for class Queue, current implementation is as an
 //	array of ent's.  This implementation was chosen to optimize
diff --git a/src/RE.cc b/src/RE.cc
index be92ec6e41..7ed075a0be 100644
--- a/src/RE.cc
+++ b/src/RE.cc
@@ -1,15 +1,16 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "RE.h"
 
 #include <stdlib.h>
 #include <utility>
 
-#include "RE.h"
 #include "DFA.h"
 #include "CCL.h"
 #include "EquivClass.h"
 #include "Reporter.h"
+#include "BroString.h"
 
 CCL* curr_ccl = 0;
 
diff --git a/src/RE.h b/src/RE.h
index ace38f2767..f1a2317659 100644
--- a/src/RE.h
+++ b/src/RE.h
@@ -2,9 +2,7 @@
 
 #pragma once
 
-#include "Obj.h"
-#include "Dict.h"
-#include "BroString.h"
+#include "List.h"
 #include "CCL.h"
 #include "EquivClass.h"
 
@@ -12,6 +10,7 @@
 #include <map>
 #include <string>
 
+#include <sys/types.h> // for u_char
 #include <ctype.h>
 typedef int (*cce_func)(int);
 
@@ -21,6 +20,7 @@ class DFA_Machine;
 class Specific_RE_Matcher;
 class RE_Matcher;
 class DFA_State;
+class BroString;
 
 extern int case_insensitive;
 extern CCL* curr_ccl;
diff --git a/src/RandTest.cc b/src/RandTest.cc
index 94e76500b5..396cd4ebde 100644
--- a/src/RandTest.cc
+++ b/src/RandTest.cc
@@ -12,9 +12,10 @@
 	Modified for Bro by Seth Hall - July 2010
 */
 
-#include <math.h>
 #include "RandTest.h"
 
+#include <math.h>
+
 #define log2of10 3.32192809488736234787
 /*  RT_LOG2  --  Calculate log to the base 2  */
 static double rt_log2(double x)
diff --git a/src/RandTest.h b/src/RandTest.h
index 32c2f38ee3..a030008eeb 100644
--- a/src/RandTest.h
+++ b/src/RandTest.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "util.h"
+#include <stdint.h>
 
 #define RT_MONTEN 6  /* Bytes used as Monte Carlo
                         co-ordinates. This should be no more
diff --git a/src/Reassem.cc b/src/Reassem.cc
index 898276d0e4..658c6fe395 100644
--- a/src/Reassem.cc
+++ b/src/Reassem.cc
@@ -1,10 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek-config.h"
+#include "Reassem.h"
+
 #include <algorithm>
 
-#include "zeek-config.h"
+#include "Desc.h"
 
-#include "Reassem.h"
+using std::min;
 
 uint64_t Reassembler::total_size = 0;
 uint64_t Reassembler::sizes[REASSEM_NUM];
diff --git a/src/Reassem.h b/src/Reassem.h
index 5c056bfd74..1baf93bc84 100644
--- a/src/Reassem.h
+++ b/src/Reassem.h
@@ -5,7 +5,10 @@
 #include <map>
 
 #include "Obj.h"
-#include "IPAddr.h"
+
+#include <assert.h>
+#include <string.h>
+#include <sys/types.h> // for u_char
 
 // Whenever subclassing the Reassembler class
 // you should add to this for known subclasses.
diff --git a/src/Reporter.cc b/src/Reporter.cc
index 5b1de82eff..7b7b6a6675 100644
--- a/src/Reporter.cc
+++ b/src/Reporter.cc
@@ -2,18 +2,23 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 //
 
+#include "zeek-config.h"
+#include "Reporter.h"
+
 #include <unistd.h>
 #include <syslog.h>
 
-#include "zeek-config.h"
-#include "Reporter.h"
+#include "Desc.h"
 #include "Event.h"
+#include "Expr.h"
 #include "NetVar.h"
 #include "Net.h"
 #include "Conn.h"
 #include "Timer.h"
+#include "EventHandler.h"
 #include "plugin/Plugin.h"
 #include "plugin/Manager.h"
+#include "input.h"
 #include "file_analysis/File.h"
 
 #ifdef SYSLOG_INT
diff --git a/src/Reporter.h b/src/Reporter.h
index 29b7c5d586..6e364dce8f 100644
--- a/src/Reporter.h
+++ b/src/Reporter.h
@@ -11,8 +11,6 @@
 #include <unordered_set>
 #include <unordered_map>
 
-#include "util.h"
-#include "EventHandler.h"
 #include "IPAddr.h"
 
 namespace analyzer { class Analyzer; }
@@ -20,6 +18,7 @@ namespace file_analysis { class File; }
 class Connection;
 class Location;
 class Reporter;
+class EventHandlerPtr;
 
 // One cannot raise this exception directly, go through the
 // Reporter's methods instead.
diff --git a/src/Rule.cc b/src/Rule.cc
index f626e7a7b7..ade2ca3f7c 100644
--- a/src/Rule.cc
+++ b/src/Rule.cc
@@ -1,6 +1,8 @@
 #include "zeek-config.h"
 
 #include "Rule.h"
+#include "RuleAction.h"
+#include "RuleCondition.h"
 #include "RuleMatcher.h"
 
 // Start at one as we want search for this within a list,
diff --git a/src/Rule.h b/src/Rule.h
index 663174f28f..5d18ae8d84 100644
--- a/src/Rule.h
+++ b/src/Rule.h
@@ -1,17 +1,17 @@
 #pragma once
 
-#include <limits.h>
-#include <map>
-
-#include "Obj.h"
 #include "List.h"
-#include "Dict.h"
-#include "util.h"
+#include "Obj.h"
+
+#include <map>
+#include <string>
+
+#include <limits.h>
+#include <stdint.h>
 
 class RuleCondition;
 class RuleAction;
 class RuleHdrTest;
-
 class Rule;
 
 typedef PList<Rule> rule_list;
diff --git a/src/RuleAction.cc b/src/RuleAction.cc
index edfe2497a2..5419e68a4c 100644
--- a/src/RuleAction.cc
+++ b/src/RuleAction.cc
@@ -12,6 +12,11 @@ using std::string;
 
 #include "analyzer/Manager.h"
 
+RuleActionEvent::RuleActionEvent(const char* arg_msg)
+	{
+	msg = copy_string(arg_msg);
+	}
+
 void RuleActionEvent::DoAction(const Rule* parent, RuleEndpointState* state,
 				const u_char* data, int len)
 	{
@@ -30,6 +35,12 @@ void RuleActionEvent::PrintDebug()
 	fprintf(stderr, "	RuleActionEvent: |%s|\n", msg);
 	}
 
+RuleActionMIME::RuleActionMIME(const char* arg_mime, int arg_strength)
+	{
+	mime = copy_string(arg_mime);
+	strength = arg_strength;
+	}
+
 void RuleActionMIME::PrintDebug()
 	{
 	fprintf(stderr, "	RuleActionMIME: |%s|\n", mime);
diff --git a/src/RuleAction.h b/src/RuleAction.h
index a20442952b..8604fa89a8 100644
--- a/src/RuleAction.h
+++ b/src/RuleAction.h
@@ -1,11 +1,13 @@
 #pragma once
 
-#include "BroString.h"
-#include "List.h"
-#include "util.h"
-
 #include "analyzer/Tag.h"
 
+#include <string>
+
+#include <sys/types.h> // for u_char
+
+using std::string;
+
 class Rule;
 class RuleEndpointState;
 
@@ -23,7 +25,7 @@ public:
 // Implements the "event" keyword.
 class RuleActionEvent : public RuleAction {
 public:
-	explicit RuleActionEvent(const char* arg_msg)	{ msg = copy_string(arg_msg); }
+	explicit RuleActionEvent(const char* arg_msg);
 	~RuleActionEvent() override { delete [] msg; }
 
 	void DoAction(const Rule* parent, RuleEndpointState* state,
@@ -37,8 +39,7 @@ private:
 
 class RuleActionMIME : public RuleAction {
 public:
-	explicit RuleActionMIME(const char* arg_mime, int arg_strength = 0)
-		{ mime = copy_string(arg_mime); strength = arg_strength; }
+	explicit RuleActionMIME(const char* arg_mime, int arg_strength = 0);
 
 	~RuleActionMIME() override
 		{ delete [] mime; }
diff --git a/src/RuleCondition.cc b/src/RuleCondition.cc
index efaa856ecd..ff42b135b9 100644
--- a/src/RuleCondition.cc
+++ b/src/RuleCondition.cc
@@ -1,8 +1,13 @@
 #include "zeek-config.h"
 
 #include "RuleCondition.h"
+#include "RuleMatcher.h"
 #include "analyzer/protocol/tcp/TCP.h"
+#include "Reporter.h"
 #include "Scope.h"
+#include "Func.h"
+#include "Val.h"
+#include "Var.h" // for internal_type()
 
 static inline bool is_established(const analyzer::tcp::TCP_Endpoint* e)
 	{
diff --git a/src/RuleCondition.h b/src/RuleCondition.h
index ee0a30dda4..d8f0b684b2 100644
--- a/src/RuleCondition.h
+++ b/src/RuleCondition.h
@@ -1,10 +1,9 @@
 #pragma once
 
-#include "BroString.h"
-#include "Func.h"
-#include "List.h"
-#include "util.h"
+#include <stdint.h> // for u_char
+#include <sys/types.h> // for u_char
 
+class ID;
 class Rule;
 class RuleEndpointState;
 
diff --git a/src/RuleMatcher.cc b/src/RuleMatcher.cc
index 747b4ce16e..d6cdae8bd2 100644
--- a/src/RuleMatcher.cc
+++ b/src/RuleMatcher.cc
@@ -1,15 +1,23 @@
+
+#include "zeek-config.h"
+#include "RuleMatcher.h"
+
 #include <algorithm>
 #include <functional>
 
-#include "zeek-config.h"
-
+#include "RuleAction.h"
+#include "RuleCondition.h"
+#include "ID.h"
+#include "IntSet.h"
+#include "IP.h"
 #include "analyzer/Analyzer.h"
-#include "RuleMatcher.h"
 #include "DFA.h"
+#include "DebugLogger.h"
 #include "NetVar.h"
 #include "Scope.h"
 #include "File.h"
 #include "Reporter.h"
+#include "module_util.h"
 
 // FIXME: Things that are not fully implemented/working yet:
 //
diff --git a/src/RuleMatcher.h b/src/RuleMatcher.h
index 9ba087d837..0650081000 100644
--- a/src/RuleMatcher.h
+++ b/src/RuleMatcher.h
@@ -1,24 +1,17 @@
 #pragma once
 
-#include <limits.h>
+#include "Rule.h"
+#include "RE.h"
+#include "CCL.h"
+
 #include <vector>
 #include <map>
 #include <functional>
 #include <set>
 #include <string>
 
-#include "IPAddr.h"
-#include "BroString.h"
-#include "List.h"
-#include "RE.h"
-#include "Net.h"
-#include "Sessions.h"
-#include "IntSet.h"
-#include "util.h"
-#include "Rule.h"
-#include "RuleAction.h"
-#include "RuleCondition.h"
-#include "iosource/Packet.h"
+#include <sys/types.h> // for u_char
+#include <limits.h>
 
 //#define MATCHER_PRINT_STATS
 
@@ -34,6 +27,18 @@ extern FILE* rules_in;
 extern int rules_line_number;
 extern const char* current_rule_file;
 
+using std::vector;
+using std::map;
+using std::set;
+using std::string;
+
+class Val;
+class BroFile;
+class IntSet;
+class IP_Hdr;
+class IPPrefix;
+class RE_Match_State;
+class Specific_RE_Matcher;
 class RuleMatcher;
 extern RuleMatcher* rule_matcher;
 
diff --git a/src/Scope.cc b/src/Scope.cc
index d4a87bc658..509f686594 100644
--- a/src/Scope.cc
+++ b/src/Scope.cc
@@ -2,10 +2,12 @@
 
 #include "zeek-config.h"
 
+#include "Scope.h"
+#include "Desc.h"
 #include "ID.h"
 #include "Val.h"
-#include "Scope.h"
 #include "Reporter.h"
+#include "module_util.h"
 
 typedef PList<Scope> scope_list;
 
diff --git a/src/Scope.h b/src/Scope.h
index 9b046fafa1..7485347669 100644
--- a/src/Scope.h
+++ b/src/Scope.h
@@ -5,11 +5,9 @@
 #include <string>
 #include <map>
 
-#include "Dict.h"
 #include "Obj.h"
 #include "BroList.h"
 #include "TraverseTypes.h"
-#include "module_util.h"
 
 class ID;
 class BroType;
diff --git a/src/SerializationFormat.cc b/src/SerializationFormat.cc
index 0bf731fcbc..1aa8346f3f 100644
--- a/src/SerializationFormat.cc
+++ b/src/SerializationFormat.cc
@@ -1,9 +1,10 @@
+#include "SerializationFormat.h"
+
 #include <ctype.h>
 
-#include "net_util.h"
-#include "SerializationFormat.h"
 #include "DebugLogger.h"
 #include "Reporter.h"
+#include "net_util.h"
 
 const float SerializationFormat::GROWTH_FACTOR = 2.5;
 
diff --git a/src/SerializationFormat.h b/src/SerializationFormat.h
index 772837ed91..5045c6af92 100644
--- a/src/SerializationFormat.h
+++ b/src/SerializationFormat.h
@@ -4,7 +4,7 @@
 
 #include <string>
 
-#include "util.h"
+#include <stdint.h>
 
 class IPAddr;
 class IPPrefix;
diff --git a/src/Sessions.cc b/src/Sessions.cc
index 981a73350b..8f66ae8633 100644
--- a/src/Sessions.cc
+++ b/src/Sessions.cc
@@ -2,6 +2,7 @@
 
 
 #include "zeek-config.h"
+#include "Sessions.h"
 
 #include <netinet/in.h>
 #include <arpa/inet.h>
@@ -9,11 +10,11 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+#include "Desc.h"
 #include "Net.h"
 #include "Event.h"
 #include "Timer.h"
 #include "NetVar.h"
-#include "Sessions.h"
 #include "Reporter.h"
 
 #include "analyzer/protocol/icmp/ICMP.h"
diff --git a/src/Sessions.h b/src/Sessions.h
index e98dd53a9c..1335e2dd88 100644
--- a/src/Sessions.h
+++ b/src/Sessions.h
@@ -2,26 +2,25 @@
 
 #pragma once
 
+#include "Frag.h"
+#include "PacketFilter.h"
+#include "NetVar.h"
+#include "analyzer/protocol/tcp/Stats.h"
+
 #include <map>
 #include <utility>
 
-#include "Dict.h"
-#include "CompHash.h"
-#include "IP.h"
-#include "Frag.h"
-#include "PacketFilter.h"
-#include "Stats.h"
-#include "NetVar.h"
-#include "TunnelEncapsulation.h"
-#include "analyzer/protocol/tcp/Stats.h"
+#include <sys/types.h> // for u_char
 
 class EncapsulationStack;
+class EncapsulatingConn;
+class Packet;
+class PacketProfiler;
 class Connection;
 class ConnCompressor;
 struct ConnID;
 
 class Discarder;
-class PacketFilter;
 
 namespace analyzer { namespace stepping_stone { class SteppingStoneManager; } }
 namespace analyzer { namespace arp { class ARP_Analyzer; } }
diff --git a/src/SmithWaterman.cc b/src/SmithWaterman.cc
index 857e45bb9b..a71b15a27f 100644
--- a/src/SmithWaterman.cc
+++ b/src/SmithWaterman.cc
@@ -9,6 +9,7 @@
 #include "Var.h"
 #include "util.h"
 #include "Reporter.h"
+#include "Val.h"
 
 BroSubstring::BroSubstring(const BroSubstring& bst)
 : BroString((const BroString&) bst), _num(), _new(bst._new)
diff --git a/src/Stats.cc b/src/Stats.cc
index cbc58c197e..39e6148fbe 100644
--- a/src/Stats.cc
+++ b/src/Stats.cc
@@ -1,15 +1,19 @@
+#include "Stats.h"
+#include "RuleMatcher.h"
 #include "Conn.h"
 #include "File.h"
 #include "Event.h"
+#include "Net.h"
 #include "NetVar.h"
+#include "Var.h" // for internal_type()
 #include "Sessions.h"
-#include "Stats.h"
 #include "Scope.h"
 #include "cq.h"
 #include "DNS_Mgr.h"
 #include "Trigger.h"
 #include "threading/Manager.h"
 #include "broker/Manager.h"
+#include "input.h"
 
 uint64_t killed_by_inactivity = 0;
 
diff --git a/src/Stats.h b/src/Stats.h
index a01997136f..0e8dea52e5 100644
--- a/src/Stats.h
+++ b/src/Stats.h
@@ -5,6 +5,12 @@
 #include <sys/types.h>
 #include <sys/time.h>
 #include <sys/resource.h>
+#include <stdint.h>
+
+class Func;
+class TableVal;
+class Location;
+class BroFile;
 
 // Object called by SegmentProfiler when it is done and reports its
 // cumulative CPU/memory statistics.
diff --git a/src/Stmt.cc b/src/Stmt.cc
index 945bd80faf..8766a1a75a 100644
--- a/src/Stmt.cc
+++ b/src/Stmt.cc
@@ -11,6 +11,7 @@
 #include "Stmt.h"
 #include "Scope.h"
 #include "Var.h"
+#include "Desc.h"
 #include "Debug.h"
 #include "Traverse.h"
 #include "Trigger.h"
@@ -92,6 +93,14 @@ void Stmt::Describe(ODesc* d) const
 		AddTag(d);
 	}
 
+void Stmt::DecrBPCount()
+	{
+	if ( breakpoint_count )
+		--breakpoint_count;
+	else
+		reporter->InternalError("breakpoint count decremented below 0");
+	}
+
 void Stmt::AddTag(ODesc* d) const
 	{
 	if ( d->IsBinary() )
@@ -1642,6 +1651,13 @@ void EventBodyList::Describe(ODesc* d) const
 		StmtList::Describe(d);
 	}
 
+InitStmt::InitStmt(id_list* arg_inits) : Stmt(STMT_INIT)
+	{
+	inits = arg_inits;
+	if ( arg_inits && arg_inits->length() )
+		SetLocationInfo((*arg_inits)[0]->GetLocationInfo());
+	}
+
 InitStmt::~InitStmt()
 	{
 	for ( const auto& init : *inits )
diff --git a/src/Stmt.h b/src/Stmt.h
index f8e14386f3..a65af2ee88 100644
--- a/src/Stmt.h
+++ b/src/Stmt.h
@@ -5,16 +5,20 @@
 // BRO statements.
 
 #include "BroList.h"
+#include "Dict.h"
+#include "ID.h"
 #include "Obj.h"
-#include "Expr.h"
-#include "Reporter.h"
 
 #include "StmtEnums.h"
 
 #include "TraverseTypes.h"
 
 class StmtList;
+class CompositeHash;
+class EventExpr;
+class ListExpr;
 class ForStmt;
+class Frame;
 
 class Stmt : public BroObj {
 public:
@@ -58,13 +62,7 @@ public:
 	void Describe(ODesc* d) const override;
 
 	virtual void IncrBPCount()	{ ++breakpoint_count; }
-	virtual void DecrBPCount()
-		{
-		if ( breakpoint_count )
-			--breakpoint_count;
-		else
-			reporter->InternalError("breakpoint count decremented below 0");
-		}
+	virtual void DecrBPCount();
 
 	virtual unsigned int BPCount() const	{ return breakpoint_count; }
 
@@ -431,12 +429,7 @@ protected:
 
 class InitStmt : public Stmt {
 public:
-	explicit InitStmt(id_list* arg_inits) : Stmt(STMT_INIT)
-		{
-		inits = arg_inits;
-		if ( arg_inits && arg_inits->length() )
-			SetLocationInfo((*arg_inits)[0]->GetLocationInfo());
-		}
+	explicit InitStmt(id_list* arg_inits);
 
 	~InitStmt() override;
 
diff --git a/src/Tag.h b/src/Tag.h
index b62c6ce3d1..a1c24702c0 100644
--- a/src/Tag.h
+++ b/src/Tag.h
@@ -3,10 +3,13 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "util.h"
-#include "Type.h"
+
+#include <string>
+
+#include <stdint.h>
 
 class EnumVal;
+class EnumType;
 
 /**
  * Class to identify an analyzer type.
diff --git a/src/Timer.h b/src/Timer.h
index 75df60a47f..5148248d20 100644
--- a/src/Timer.h
+++ b/src/Timer.h
@@ -2,10 +2,11 @@
 
 #pragma once
 
-#include <string>
 #include "PriorityQueue.h"
 #include "iosource/IOSource.h"
 
+#include <stdint.h>
+
 // If you add a timer here, adjust TimerNames in Timer.cc.
 enum TimerType : uint8_t {
 	TIMER_BACKDOOR,
diff --git a/src/Traverse.cc b/src/Traverse.cc
index d19c6d3801..b9aa28b42d 100644
--- a/src/Traverse.cc
+++ b/src/Traverse.cc
@@ -2,6 +2,7 @@
 
 #include "Scope.h"
 #include "Traverse.h"
+#include "Stmt.h"
 #include "input.h"
 
 TraversalCode traverse_all(TraversalCallback* cb)
diff --git a/src/Traverse.h b/src/Traverse.h
index 834611b0d9..2ef672ddd7 100644
--- a/src/Traverse.h
+++ b/src/Traverse.h
@@ -2,14 +2,14 @@
 
 #pragma once
 
-#include "Obj.h"
-#include "Stmt.h"
-#include "Expr.h"
-#include "ID.h"
-#include "Scope.h"
-
 #include "TraverseTypes.h"
 
+class Func;
+class Scope;
+class Stmt;
+class Expr;
+class ID;
+
 class TraversalCallback {
 public:
 	TraversalCallback()	{ current_scope = 0; }
diff --git a/src/Trigger.cc b/src/Trigger.cc
index 271edf24aa..5a600074a6 100644
--- a/src/Trigger.cc
+++ b/src/Trigger.cc
@@ -1,7 +1,18 @@
+#include "Trigger.h"
+
 #include <algorithm>
 
-#include "Trigger.h"
+#include <assert.h>
+
 #include "Traverse.h"
+#include "Expr.h"
+#include "Frame.h"
+#include "ID.h"
+#include "Val.h"
+#include "Stmt.h"
+#include "Reporter.h"
+#include "Desc.h"
+#include "DebugLogger.h"
 #include "iosource/Manager.h"
 
 using namespace trigger;
@@ -464,6 +475,11 @@ void Trigger::Disable()
 	disabled = true;
 	}
 
+void Trigger::Describe(ODesc* d) const
+	{
+	d->Add("<trigger>");
+	}
+
 void Trigger::Modified(notifier::Modifiable* m)
 	{
 	trigger_mgr->Queue(this);
diff --git a/src/Trigger.h b/src/Trigger.h
index c3efd62138..685f8ec129 100644
--- a/src/Trigger.h
+++ b/src/Trigger.h
@@ -1,16 +1,27 @@
 #pragma once
 
+#include "Obj.h"
+#include "Notifier.h"
+#include "iosource/IOSource.h"
+
 #include <list>
+#include <vector>
 #include <map>
 
-#include "Notifier.h"
-#include "Traverse.h"
-#include "iosource/IOSource.h"
+class CallExpr;
+class Expr;
+class Stmt;
+class Frame;
+class Val;
+class ID;
+class ODesc;
 
 namespace trigger {
 // Triggers are the heart of "when" statements: expressions that when
 // they become true execute a body of statements.
 
+using std::map;
+
 class TriggerTimer;
 class TriggerTraversalCallback;
 
@@ -58,8 +69,7 @@ public:
 
 	bool Disabled() const { return disabled; }
 
-	void Describe(ODesc* d) const override
-		{ d->Add("<trigger>"); }
+	void Describe(ODesc* d) const override;
 
 	// Overidden from Notifier.  We queue the trigger and evaluate it
 	// later to avoid race conditions.
diff --git a/src/TunnelEncapsulation.h b/src/TunnelEncapsulation.h
index ca762eb704..4f18b6118b 100644
--- a/src/TunnelEncapsulation.h
+++ b/src/TunnelEncapsulation.h
@@ -5,10 +5,12 @@
 #include "zeek-config.h"
 #include "NetVar.h"
 #include "IPAddr.h"
-#include "Val.h"
+#include "Var.h" // for internal_type()
 #include "UID.h"
+
 #include <vector>
 
+using std::vector;
 class Connection;
 
 /**
diff --git a/src/Type.cc b/src/Type.cc
index 6a4139bc8b..f9bb36db01 100644
--- a/src/Type.cc
+++ b/src/Type.cc
@@ -4,11 +4,17 @@
 
 #include "Type.h"
 #include "Attr.h"
+#include "Desc.h"
 #include "Expr.h"
 #include "Scope.h"
+#include "Val.h"
+#include "Var.h"
 #include "Reporter.h"
 #include "zeekygen/Manager.h"
+#include "zeekygen/IdentifierInfo.h"
+#include "zeekygen/ScriptInfo.h"
 #include "zeekygen/utils.h"
+#include "module_util.h"
 
 #include <string>
 #include <list>
@@ -267,6 +273,13 @@ void TypeList::Describe(ODesc* d) const
 		}
 	}
 
+unsigned int TypeList::MemoryAllocation() const
+	{
+	return BroType::MemoryAllocation()
+		+ padded_sizeof(*this) - padded_sizeof(BroType)
+		+ types.MemoryAllocation() - padded_sizeof(types);
+	}
+
 IndexType::~IndexType()
 	{
 	Unref(indices);
diff --git a/src/Type.h b/src/Type.h
index 371e4385a5..4ea3caf318 100644
--- a/src/Type.h
+++ b/src/Type.h
@@ -2,17 +2,16 @@
 
 #pragma once
 
+#include "Obj.h"
+#include "Attr.h"
+#include "BroList.h"
+
 #include <string>
 #include <set>
 #include <unordered_map>
 #include <map>
 #include <list>
 
-#include "Obj.h"
-#include "Attr.h"
-#include "BroList.h"
-#include "Dict.h"
-
 // BRO types.
 
 typedef enum {
@@ -319,12 +318,7 @@ public:
 
 	void Describe(ODesc* d) const override;
 
-	unsigned int MemoryAllocation() const override
-		{
-		return BroType::MemoryAllocation()
-			+ padded_sizeof(*this) - padded_sizeof(BroType)
-			+ types.MemoryAllocation() - padded_sizeof(types);
-		}
+	unsigned int MemoryAllocation() const override;
 
 protected:
 	BroType* pure_type;
diff --git a/src/UID.cc b/src/UID.cc
index 378a50b873..73d61873be 100644
--- a/src/UID.cc
+++ b/src/UID.cc
@@ -1,8 +1,10 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <cstdlib>
-
 #include "UID.h"
+#include "Reporter.h"
+#include "util.h"
+
+#include <cstdlib>
 
 using namespace Bro;
 using namespace std;
@@ -26,3 +28,15 @@ void UID::Set(bro_uint_t bits, const uint64_t* v, size_t n)
 	if ( res.rem )
 		uid[0] >>= 64 - res.rem;
 	}
+
+std::string UID::Base62(std::string prefix) const
+	{
+	if ( ! initialized )
+		reporter->InternalError("use of uninitialized UID");
+
+	char tmp[sizeof(uid) * 8 + 1];  // enough for even binary representation
+	for ( size_t i = 0; i < BRO_UID_LEN; ++i )
+		prefix.append(uitoa_n(uid[i], tmp, sizeof(tmp), 62));
+
+	return prefix;
+	}
diff --git a/src/UID.h b/src/UID.h
index 9f1cd75c8d..711541e283 100644
--- a/src/UID.h
+++ b/src/UID.h
@@ -2,10 +2,11 @@
 
 #pragma once
 
+#include "util.h" // for bro_int_t
+
 #include <string>
 
-#include "Reporter.h"
-#include "util.h"
+#include <string.h>
 
 #define BRO_UID_LEN 2
 
@@ -97,16 +98,4 @@ inline UID& UID::operator=(const UID& other)
 	return *this;
 	}
 
-inline std::string UID::Base62(std::string prefix) const
-	{
-	if ( ! initialized )
-		reporter->InternalError("use of uninitialized UID");
-
-	char tmp[sizeof(uid) * 8 + 1];  // enough for even binary representation
-	for ( size_t i = 0; i < BRO_UID_LEN; ++i )
-		prefix.append(uitoa_n(uid[i], tmp, sizeof(tmp), 62));
-
-	return prefix;
-	}
-
 } // namespace Bro
diff --git a/src/Val.cc b/src/Val.cc
index 2c690c590e..aace4d5a6f 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -1,6 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "Val.h"
 
 #include <sys/types.h>
 #include <sys/param.h>
@@ -12,10 +13,13 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "Val.h"
+#include "Attr.h"
 #include "Net.h"
 #include "File.h"
 #include "Func.h"
+#include "Desc.h"
+#include "IntrusivePtr.h"
+#include "ID.h"
 #include "RE.h"
 #include "Scope.h"
 #include "NetVar.h"
@@ -358,6 +362,14 @@ void Val::ValDescribeReST(ODesc* d) const
 	}
 
 
+#ifdef DEBUG
+void Val::SetID(ID* id)
+	{
+	delete [] bound_id;
+	bound_id = id ? copy_string(id->Name()) : 0;
+	}
+#endif
+
 bool Val::WouldOverflow(const BroType* from_type, const BroType* to_type, const Val* val)
 	{
 	if ( !to_type || !from_type )
@@ -1991,6 +2003,11 @@ ListVal* TableVal::ConvertToPureList() const
 	return ConvertToList((*tl)[0]->Tag());
 	}
 
+Attr* TableVal::FindAttr(attr_tag t) const
+	{
+	return attrs ? attrs->FindAttr(t) : 0;
+	}
+
 void TableVal::Describe(ODesc* d) const
 	{
 	const PDict<TableEntryVal>* tbl = AsTable();
diff --git a/src/Val.h b/src/Val.h
index cda2dd43f8..e7323f2965 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -2,24 +2,25 @@
 
 #pragma once
 
+#include "Type.h"
+#include "Dict.h"
+#include "CompHash.h"
+#include "BroString.h"
+#include "Timer.h"
+#include "Scope.h"
+#include "Notifier.h"
+#include "RE.h"
+#include "net_util.h"
+
 #include <vector>
 #include <list>
 #include <array>
 #include <unordered_map>
 
-#include "net_util.h"
-#include "Type.h"
-#include "Dict.h"
-#include "CompHash.h"
-#include "BroString.h"
-#include "Attr.h"
-#include "Timer.h"
-#include "ID.h"
-#include "Scope.h"
-#include "Notifier.h"
-#include "IPAddr.h"
-#include "DebugLogger.h"
-#include "RE.h"
+#include <sys/types.h> // for u_char
+
+using std::vector;
+using std::string;
 
 // We have four different port name spaces: TCP, UDP, ICMP, and UNKNOWN.
 // We distinguish between them based on the bits specified in the *_PORT_MASK
@@ -50,6 +51,9 @@ class StringVal;
 class EnumVal;
 class OpaqueVal;
 
+class IPAddr;
+class IPPrefix;
+
 class StateAccess;
 
 class VectorVal;
@@ -287,11 +291,7 @@ public:
 		return bound_id ? global_scope()->Lookup(bound_id) : 0;
 		}
 
-	void SetID(ID* id)
-		{
-		delete [] bound_id;
-		bound_id = id ? copy_string(id->Name()) : 0;
-		}
+	void SetID(ID* id);
 #endif
 
 	static bool WouldOverflow(const BroType* from_type, const BroType* to_type, const Val* val);
@@ -786,8 +786,7 @@ public:
 	ListVal* ConvertToPureList() const;	// must be single index type
 
 	void SetAttrs(Attributes* attrs);
-	Attr* FindAttr(attr_tag t) const
-		{ return attrs ? attrs->FindAttr(t) : 0; }
+	Attr* FindAttr(attr_tag t) const;
 	Attributes* Attrs()	{ return attrs; }
 
 	// Returns the size of the table.
diff --git a/src/Var.cc b/src/Var.cc
index 212ee58a54..971a09cfa9 100644
--- a/src/Var.cc
+++ b/src/Var.cc
@@ -1,15 +1,19 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek-config.h"
+#include "Var.h"
+
 #include <memory>
 
-#include "zeek-config.h"
-
-#include "Var.h"
+#include "Val.h"
+#include "Expr.h"
 #include "Func.h"
 #include "Stmt.h"
 #include "Scope.h"
+#include "Reporter.h"
 #include "EventRegistry.h"
 #include "Traverse.h"
+#include "module_util.h"
 
 static Val* init_val(Expr* init, const BroType* t, Val* aggr)
 	{
diff --git a/src/Var.h b/src/Var.h
index 5ae6720b62..0282c4a489 100644
--- a/src/Var.h
+++ b/src/Var.h
@@ -2,15 +2,17 @@
 
 #pragma once
 
-#include <memory> // std::unique_ptr
-
 #include "ID.h"
-#include "Expr.h"
 #include "Type.h"
-#include "Func.h" // function_ingredients
 
-class Func;
+class Expr;
+class FuncType;
+class Stmt;
+class Scope;
 class EventHandlerPtr;
+class StringVal;
+class TableVal;
+class ListVal;
 
 typedef enum { VAR_REGULAR, VAR_CONST, VAR_REDEF, VAR_OPTION, } decl_type;
 
diff --git a/src/WeirdState.cc b/src/WeirdState.cc
index 1f1407a1d2..48a74e32cf 100644
--- a/src/WeirdState.cc
+++ b/src/WeirdState.cc
@@ -1,5 +1,6 @@
 #include "WeirdState.h"
 #include "Net.h"
+#include "util.h"
 
 bool PermitWeird(WeirdStateMap& wsm, const char* name, uint64_t threshold,
                  uint64_t rate, double duration)
diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h
index a896563abe..2fcde63187 100644
--- a/src/analyzer/Analyzer.h
+++ b/src/analyzer/Analyzer.h
@@ -2,15 +2,21 @@
 
 #pragma once
 
-#include <list>
-#include <vector>
-
 #include "Tag.h"
 
 #include "../Obj.h"
 #include "../EventHandler.h"
 #include "../Timer.h"
 
+#include <list>
+#include <vector>
+
+#include <sys/types.h> // for u_char
+
+using std::list;
+using std::string;
+
+class BroFile;
 class Rule;
 class Connection;
 class IP_Hdr;
diff --git a/src/analyzer/Tag.h b/src/analyzer/Tag.h
index b36d10863b..46545e4bd1 100644
--- a/src/analyzer/Tag.h
+++ b/src/analyzer/Tag.h
@@ -3,13 +3,17 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "util.h"
 #include "../Tag.h"
-#include "plugin/TaggedComponent.h"
-#include "plugin/ComponentManager.h"
 
 class EnumVal;
 
+namespace plugin {
+template <class T>
+class TaggedComponent;
+template <class T, class C>
+class ComponentManager;
+}
+
 namespace analyzer {
 
 class Manager;
diff --git a/src/analyzer/protocol/arp/ARP.cc b/src/analyzer/protocol/arp/ARP.cc
index fe56a446e0..360a24d5bd 100644
--- a/src/analyzer/protocol/arp/ARP.cc
+++ b/src/analyzer/protocol/arp/ARP.cc
@@ -3,6 +3,7 @@
 #include "ARP.h"
 #include "Event.h"
 #include "Reporter.h"
+#include "Desc.h"
 
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/ayiya/Plugin.cc b/src/analyzer/protocol/ayiya/Plugin.cc
index 2b4b8ee7d9..23c04543e3 100644
--- a/src/analyzer/protocol/ayiya/Plugin.cc
+++ b/src/analyzer/protocol/ayiya/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "AYIYA.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_AYIYA {
diff --git a/src/analyzer/protocol/ayiya/ayiya-analyzer.pac b/src/analyzer/protocol/ayiya/ayiya-analyzer.pac
index 1d8cbe90b6..67a74f4444 100644
--- a/src/analyzer/protocol/ayiya/ayiya-analyzer.pac
+++ b/src/analyzer/protocol/ayiya/ayiya-analyzer.pac
@@ -1,3 +1,6 @@
+%extern{
+#include "Sessions.h"
+%}
 
 connection AYIYA_Conn(bro_analyzer: BroAnalyzer)
 	{
diff --git a/src/analyzer/protocol/ayiya/ayiya.pac b/src/analyzer/protocol/ayiya/ayiya.pac
index ff0af4d47c..ad4b7582a8 100644
--- a/src/analyzer/protocol/ayiya/ayiya.pac
+++ b/src/analyzer/protocol/ayiya/ayiya.pac
@@ -2,6 +2,12 @@
 %include binpac.pac
 %include bro.pac
 
+%extern{
+#include "IP.h"
+#include "Reporter.h"
+#include "TunnelEncapsulation.h"
+%}
+
 analyzer AYIYA withcontext {
 	connection:	AYIYA_Conn;
 	flow:		AYIYA_Flow;
diff --git a/src/analyzer/protocol/bittorrent/BitTorrentTracker.h b/src/analyzer/protocol/bittorrent/BitTorrentTracker.h
index d86216cb18..0663901229 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrentTracker.h
+++ b/src/analyzer/protocol/bittorrent/BitTorrentTracker.h
@@ -6,6 +6,8 @@
 
 #define BTTRACKER_BUF 2048
 
+class StringVal;
+
 namespace analyzer { namespace bittorrent {
 
 // If the following is defined, then the analyzer will store all of
diff --git a/src/analyzer/protocol/bittorrent/Plugin.cc b/src/analyzer/protocol/bittorrent/Plugin.cc
index 14f778ac9f..c9d94aa16f 100644
--- a/src/analyzer/protocol/bittorrent/Plugin.cc
+++ b/src/analyzer/protocol/bittorrent/Plugin.cc
@@ -1,10 +1,9 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "BitTorrent.h"
 #include "BitTorrentTracker.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_BitTorrent {
diff --git a/src/analyzer/protocol/conn-size/ConnSize.cc b/src/analyzer/protocol/conn-size/ConnSize.cc
index 4b0b542ac8..58e8ccb857 100644
--- a/src/analyzer/protocol/conn-size/ConnSize.cc
+++ b/src/analyzer/protocol/conn-size/ConnSize.cc
@@ -5,6 +5,8 @@
 
 #include "ConnSize.h"
 #include "analyzer/protocol/tcp/TCP.h"
+#include "IP.h"
+#include "Reporter.h"
 
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/conn-size/Plugin.cc b/src/analyzer/protocol/conn-size/Plugin.cc
index ce1b600da2..1ba5225278 100644
--- a/src/analyzer/protocol/conn-size/Plugin.cc
+++ b/src/analyzer/protocol/conn-size/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "ConnSize.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_ConnSize {
diff --git a/src/analyzer/protocol/conn-size/functions.bif b/src/analyzer/protocol/conn-size/functions.bif
index 74d153363e..24b51c895e 100644
--- a/src/analyzer/protocol/conn-size/functions.bif
+++ b/src/analyzer/protocol/conn-size/functions.bif
@@ -1,5 +1,7 @@
 %%{
 #include "analyzer/protocol/conn-size/ConnSize.h"
+#include "Reporter.h"
+#include "Sessions.h"
 
 static analyzer::Analyzer* GetConnsizeAnalyzer(Val* cid)
 	{
diff --git a/src/analyzer/protocol/dhcp/Plugin.cc b/src/analyzer/protocol/dhcp/Plugin.cc
index 62318604c4..f4895255ed 100644
--- a/src/analyzer/protocol/dhcp/Plugin.cc
+++ b/src/analyzer/protocol/dhcp/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "DHCP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_DHCP {
diff --git a/src/analyzer/protocol/dnp3/DNP3.cc b/src/analyzer/protocol/dnp3/DNP3.cc
index 1812f21aba..8d22e32e2f 100644
--- a/src/analyzer/protocol/dnp3/DNP3.cc
+++ b/src/analyzer/protocol/dnp3/DNP3.cc
@@ -97,6 +97,7 @@
 //                                            Binpac DNP3 Analyzer
 
 #include "DNP3.h"
+#include "Reporter.h"
 #include "events.bif.h"
 
 using namespace analyzer::dnp3;
diff --git a/src/analyzer/protocol/dnp3/Plugin.cc b/src/analyzer/protocol/dnp3/Plugin.cc
index 8543360b6a..e75e19f4c5 100644
--- a/src/analyzer/protocol/dnp3/Plugin.cc
+++ b/src/analyzer/protocol/dnp3/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "DNP3.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_DNP3 {
diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc
index eab5b48461..a4868056f6 100644
--- a/src/analyzer/protocol/dns/DNS.cc
+++ b/src/analyzer/protocol/dns/DNS.cc
@@ -1,6 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "DNS.h"
 
 #include <ctype.h>
 #include <sys/types.h>
@@ -9,9 +10,9 @@
 #include <arpa/inet.h>
 
 #include "NetVar.h"
-#include "DNS.h"
 #include "Sessions.h"
 #include "Event.h"
+#include "Net.h"
 
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/dns/Plugin.cc b/src/analyzer/protocol/dns/Plugin.cc
index 3ceef34ea1..d360a1771c 100644
--- a/src/analyzer/protocol/dns/Plugin.cc
+++ b/src/analyzer/protocol/dns/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "DNS.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_DNS {
diff --git a/src/analyzer/protocol/file/Plugin.cc b/src/analyzer/protocol/file/Plugin.cc
index 36586fb6a9..974c5949a3 100644
--- a/src/analyzer/protocol/file/Plugin.cc
+++ b/src/analyzer/protocol/file/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
+#include "File.h"
 #include "plugin/Plugin.h"
-
-#include "./File.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_File {
diff --git a/src/analyzer/protocol/finger/Plugin.cc b/src/analyzer/protocol/finger/Plugin.cc
index b6fafd3b4c..825860b49e 100644
--- a/src/analyzer/protocol/finger/Plugin.cc
+++ b/src/analyzer/protocol/finger/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "Finger.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_Finger {
diff --git a/src/analyzer/protocol/ftp/FTP.cc b/src/analyzer/protocol/ftp/FTP.cc
index da86ad7db4..26bb780caa 100644
--- a/src/analyzer/protocol/ftp/FTP.cc
+++ b/src/analyzer/protocol/ftp/FTP.cc
@@ -1,15 +1,16 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "FTP.h"
 
 #include <stdlib.h>
 
 #include "NetVar.h"
-#include "FTP.h"
 #include "Event.h"
 #include "Base64.h"
 #include "analyzer/Manager.h"
 #include "analyzer/protocol/login/NVT.h"
+#include "RuleMatcher.h"
 
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/ftp/FTP.h b/src/analyzer/protocol/ftp/FTP.h
index 6bf0edd46a..47d93e8f10 100644
--- a/src/analyzer/protocol/ftp/FTP.h
+++ b/src/analyzer/protocol/ftp/FTP.h
@@ -2,9 +2,10 @@
 
 #pragma once
 
-#include "analyzer/protocol/login/NVT.h"
 #include "analyzer/protocol/tcp/TCP.h"
 
+namespace analyzer { namespace login { class NVT_Analyzer; }}
+
 namespace analyzer { namespace ftp {
 
 class FTP_Analyzer : public tcp::TCP_ApplicationAnalyzer {
diff --git a/src/analyzer/protocol/ftp/Plugin.cc b/src/analyzer/protocol/ftp/Plugin.cc
index ae70d2f705..1cade7807d 100644
--- a/src/analyzer/protocol/ftp/Plugin.cc
+++ b/src/analyzer/protocol/ftp/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "FTP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_FTP {
diff --git a/src/analyzer/protocol/ftp/functions.bif b/src/analyzer/protocol/ftp/functions.bif
index facabeb679..7f2b6cf643 100644
--- a/src/analyzer/protocol/ftp/functions.bif
+++ b/src/analyzer/protocol/ftp/functions.bif
@@ -2,6 +2,7 @@
 type ftp_port: record;
 
 %%{
+#include "Reporter.h"
 
 static Val* parse_port(const char* line)
 	{
diff --git a/src/analyzer/protocol/gnutella/Plugin.cc b/src/analyzer/protocol/gnutella/Plugin.cc
index b6a560ec58..93031060ee 100644
--- a/src/analyzer/protocol/gnutella/Plugin.cc
+++ b/src/analyzer/protocol/gnutella/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "Gnutella.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_Gnutella {
diff --git a/src/analyzer/protocol/gtpv1/Plugin.cc b/src/analyzer/protocol/gtpv1/Plugin.cc
index 4b7929a747..6ea6230e16 100644
--- a/src/analyzer/protocol/gtpv1/Plugin.cc
+++ b/src/analyzer/protocol/gtpv1/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "GTPv1.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_GTPv1 {
diff --git a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
index 6cf9439363..b693f4e792 100644
--- a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
+++ b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
@@ -1,3 +1,6 @@
+%extern{
+#include "Sessions.h"
+%}
 
 %code{
 RecordVal* BuildGTPv1Hdr(const GTPv1_Header* pdu)
diff --git a/src/analyzer/protocol/gtpv1/gtpv1.pac b/src/analyzer/protocol/gtpv1/gtpv1.pac
index 0305951cc5..6223df22d6 100644
--- a/src/analyzer/protocol/gtpv1/gtpv1.pac
+++ b/src/analyzer/protocol/gtpv1/gtpv1.pac
@@ -2,6 +2,9 @@
 %include bro.pac
 
 %extern{
+#include "IP.h"
+#include "TunnelEncapsulation.h"
+#include "Reporter.h"
 #include "events.bif.h"
 %}
 
diff --git a/src/analyzer/protocol/http/Plugin.cc b/src/analyzer/protocol/http/Plugin.cc
index f2b7402415..fcd8f29444 100644
--- a/src/analyzer/protocol/http/Plugin.cc
+++ b/src/analyzer/protocol/http/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "HTTP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_HTTP {
diff --git a/src/analyzer/protocol/icmp/ICMP.cc b/src/analyzer/protocol/icmp/ICMP.cc
index 433284ac7b..145c00dfee 100644
--- a/src/analyzer/protocol/icmp/ICMP.cc
+++ b/src/analyzer/protocol/icmp/ICMP.cc
@@ -1,14 +1,18 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "ICMP.h"
+
 #include <algorithm>
 
 #include "zeek-config.h"
 
+#include "IP.h"
 #include "Net.h"
 #include "NetVar.h"
 #include "Event.h"
-#include "ICMP.h"
 #include "Conn.h"
+#include "Desc.h"
+#include "Reporter.h"
 
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/icmp/ICMP.h b/src/analyzer/protocol/icmp/ICMP.h
index 042052266f..7106f53dd9 100644
--- a/src/analyzer/protocol/icmp/ICMP.h
+++ b/src/analyzer/protocol/icmp/ICMP.h
@@ -4,6 +4,9 @@
 
 #include "RuleMatcher.h"
 #include "analyzer/Analyzer.h"
+#include "net_util.h"
+
+class VectorVal;
 
 namespace analyzer { namespace icmp {
 
diff --git a/src/analyzer/protocol/icmp/Plugin.cc b/src/analyzer/protocol/icmp/Plugin.cc
index 390eb751d1..2aef006315 100644
--- a/src/analyzer/protocol/icmp/Plugin.cc
+++ b/src/analyzer/protocol/icmp/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "ICMP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_ICMP {
diff --git a/src/analyzer/protocol/ident/Plugin.cc b/src/analyzer/protocol/ident/Plugin.cc
index 23a798a72f..5398ba0523 100644
--- a/src/analyzer/protocol/ident/Plugin.cc
+++ b/src/analyzer/protocol/ident/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "Ident.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_Ident {
diff --git a/src/analyzer/protocol/imap/Plugin.cc b/src/analyzer/protocol/imap/Plugin.cc
index 3192ea8f28..bbdac9b444 100644
--- a/src/analyzer/protocol/imap/Plugin.cc
+++ b/src/analyzer/protocol/imap/Plugin.cc
@@ -1,6 +1,8 @@
 // See the file  in the main distribution directory for copyright.
-#include "plugin/Plugin.h"
+
 #include "IMAP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_IMAP {
diff --git a/src/analyzer/protocol/imap/imap.pac b/src/analyzer/protocol/imap/imap.pac
index f5c7559294..4f16af8523 100644
--- a/src/analyzer/protocol/imap/imap.pac
+++ b/src/analyzer/protocol/imap/imap.pac
@@ -7,6 +7,7 @@
 %include bro.pac
 
 %extern{
+#include "Reporter.h"
 #include "events.bif.h"
 
 namespace analyzer { namespace imap { class IMAP_Analyzer; } }
diff --git a/src/analyzer/protocol/irc/Plugin.cc b/src/analyzer/protocol/irc/Plugin.cc
index fc63baad12..b4d7266472 100644
--- a/src/analyzer/protocol/irc/Plugin.cc
+++ b/src/analyzer/protocol/irc/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "IRC.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_IRC {
diff --git a/src/analyzer/protocol/krb/KRB.cc b/src/analyzer/protocol/krb/KRB.cc
index 65e764eca1..890947e5b7 100644
--- a/src/analyzer/protocol/krb/KRB.cc
+++ b/src/analyzer/protocol/krb/KRB.cc
@@ -1,8 +1,9 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "KRB.h"
+
 #include <unistd.h>
 
-#include "KRB.h"
 #include "types.bif.h"
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/krb/Plugin.cc b/src/analyzer/protocol/krb/Plugin.cc
index 707498f729..567fd080c8 100644
--- a/src/analyzer/protocol/krb/Plugin.cc
+++ b/src/analyzer/protocol/krb/Plugin.cc
@@ -1,8 +1,9 @@
 //See the file in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
 #include "KRB.h"
 #include "KRB_TCP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 	namespace Zeek_KRB {
diff --git a/src/analyzer/protocol/krb/krb-padata.pac b/src/analyzer/protocol/krb/krb-padata.pac
index feb1089815..66025afda4 100644
--- a/src/analyzer/protocol/krb/krb-padata.pac
+++ b/src/analyzer/protocol/krb/krb-padata.pac
@@ -3,6 +3,7 @@
 
 %extern{
 #include "file_analysis/Manager.h"
+#include "Desc.h"
 %}
 
 %header{
diff --git a/src/analyzer/protocol/login/Login.cc b/src/analyzer/protocol/login/Login.cc
index 277bb752ff..5bca5930c6 100644
--- a/src/analyzer/protocol/login/Login.cc
+++ b/src/analyzer/protocol/login/Login.cc
@@ -1,13 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "Login.h"
 
 #include <ctype.h>
 #include <stdlib.h>
 
 #include "NetVar.h"
-#include "Login.h"
 #include "RE.h"
+#include "Reporter.h"
 #include "Event.h"
 
 #include "events.bif.h"
diff --git a/src/analyzer/protocol/login/NVT.cc b/src/analyzer/protocol/login/NVT.cc
index 3cc9bdb1e0..0105df59f0 100644
--- a/src/analyzer/protocol/login/NVT.cc
+++ b/src/analyzer/protocol/login/NVT.cc
@@ -1,12 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "NVT.h"
 
 #include <stdlib.h>
 
-#include "NVT.h"
 #include "NetVar.h"
 #include "Event.h"
+#include "Reporter.h"
 #include "analyzer/protocol/tcp/TCP.h"
 
 #include "events.bif.h"
diff --git a/src/analyzer/protocol/login/Plugin.cc b/src/analyzer/protocol/login/Plugin.cc
index 182c070592..86cac17a14 100644
--- a/src/analyzer/protocol/login/Plugin.cc
+++ b/src/analyzer/protocol/login/Plugin.cc
@@ -1,12 +1,11 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "Login.h"
 #include "Telnet.h"
 #include "RSH.h"
 #include "Rlogin.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_Login {
diff --git a/src/analyzer/protocol/login/RSH.cc b/src/analyzer/protocol/login/RSH.cc
index 7fc5f932e0..ef9fb3fa18 100644
--- a/src/analyzer/protocol/login/RSH.cc
+++ b/src/analyzer/protocol/login/RSH.cc
@@ -2,9 +2,10 @@
 
 #include "zeek-config.h"
 
+#include "RSH.h"
 #include "NetVar.h"
 #include "Event.h"
-#include "RSH.h"
+#include "Reporter.h"
 
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/login/Rlogin.cc b/src/analyzer/protocol/login/Rlogin.cc
index 62b391849b..bed3c0317d 100644
--- a/src/analyzer/protocol/login/Rlogin.cc
+++ b/src/analyzer/protocol/login/Rlogin.cc
@@ -2,9 +2,10 @@
 
 #include "zeek-config.h"
 
+#include "Rlogin.h"
 #include "NetVar.h"
 #include "Event.h"
-#include "Rlogin.h"
+#include "Reporter.h"
 
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/login/functions.bif b/src/analyzer/protocol/login/functions.bif
index 932020595c..2872a5aa02 100644
--- a/src/analyzer/protocol/login/functions.bif
+++ b/src/analyzer/protocol/login/functions.bif
@@ -1,6 +1,8 @@
 
 %%{
 #include "Login.h"
+#include "Reporter.h"
+#include "Sessions.h"
 %%}
 
 ## Returns the state of the given login (Telnet or Rlogin) connection.
diff --git a/src/analyzer/protocol/mime/MIME.cc b/src/analyzer/protocol/mime/MIME.cc
index b62dc11633..e13688d81b 100644
--- a/src/analyzer/protocol/mime/MIME.cc
+++ b/src/analyzer/protocol/mime/MIME.cc
@@ -1,8 +1,8 @@
 #include "zeek-config.h"
 
-#include "NetVar.h"
 #include "MIME.h"
-#include "Event.h"
+#include "NetVar.h"
+#include "Base64.h"
 #include "Reporter.h"
 #include "digest.h"
 #include "file_analysis/Manager.h"
diff --git a/src/analyzer/protocol/mime/MIME.h b/src/analyzer/protocol/mime/MIME.h
index 0a5b05283b..33acab12be 100644
--- a/src/analyzer/protocol/mime/MIME.h
+++ b/src/analyzer/protocol/mime/MIME.h
@@ -7,10 +7,13 @@
 #include <queue>
 using namespace std;
 
-#include "Base64.h"
 #include "BroString.h"
+#include "Reporter.h"
 #include "analyzer/Analyzer.h"
 
+class StringVal;
+class Base64Converter;
+
 namespace analyzer { namespace mime {
 
 // MIME: Multipurpose Internet Mail Extensions
diff --git a/src/analyzer/protocol/modbus/Plugin.cc b/src/analyzer/protocol/modbus/Plugin.cc
index 68b78fcbe7..ee89d8efc1 100644
--- a/src/analyzer/protocol/modbus/Plugin.cc
+++ b/src/analyzer/protocol/modbus/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "Modbus.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_Modbus {
diff --git a/src/analyzer/protocol/mqtt/Plugin.cc b/src/analyzer/protocol/mqtt/Plugin.cc
index 6ebcbb89ba..8640fde129 100644
--- a/src/analyzer/protocol/mqtt/Plugin.cc
+++ b/src/analyzer/protocol/mqtt/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "MQTT.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin { 
 namespace Zeek_MQTT {
diff --git a/src/analyzer/protocol/mysql/Plugin.cc b/src/analyzer/protocol/mysql/Plugin.cc
index 0f484e29ce..e4f7ec4549 100644
--- a/src/analyzer/protocol/mysql/Plugin.cc
+++ b/src/analyzer/protocol/mysql/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "MySQL.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 	namespace Zeek_MySQL {
diff --git a/src/analyzer/protocol/ncp/Plugin.cc b/src/analyzer/protocol/ncp/Plugin.cc
index 9ea75a4674..5e54f977bb 100644
--- a/src/analyzer/protocol/ncp/Plugin.cc
+++ b/src/analyzer/protocol/ncp/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "NCP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_NCP {
diff --git a/src/analyzer/protocol/netbios/NetbiosSSN.cc b/src/analyzer/protocol/netbios/NetbiosSSN.cc
index 5d5ef06080..4aedd0d0f0 100644
--- a/src/analyzer/protocol/netbios/NetbiosSSN.cc
+++ b/src/analyzer/protocol/netbios/NetbiosSSN.cc
@@ -1,13 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "NetbiosSSN.h"
 
 #include <ctype.h>
 
 #include "NetVar.h"
-#include "NetbiosSSN.h"
 #include "Sessions.h"
 #include "Event.h"
+#include "Net.h"
 
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/netbios/Plugin.cc b/src/analyzer/protocol/netbios/Plugin.cc
index 7f49cdfb09..3024c48acd 100644
--- a/src/analyzer/protocol/netbios/Plugin.cc
+++ b/src/analyzer/protocol/netbios/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "NetbiosSSN.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_NetBIOS {
diff --git a/src/analyzer/protocol/netbios/functions.bif b/src/analyzer/protocol/netbios/functions.bif
index c86156931f..37a13a7678 100644
--- a/src/analyzer/protocol/netbios/functions.bif
+++ b/src/analyzer/protocol/netbios/functions.bif
@@ -1,3 +1,6 @@
+%%{
+#include "Reporter.h"
+%%}
 
 ## Decode a NetBIOS name.  See http://support.microsoft.com/kb/194203.
 ##
diff --git a/src/analyzer/protocol/ntp/Plugin.cc b/src/analyzer/protocol/ntp/Plugin.cc
index edb2b8c3d7..30210731b2 100644
--- a/src/analyzer/protocol/ntp/Plugin.cc
+++ b/src/analyzer/protocol/ntp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "NTP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_NTP {
diff --git a/src/analyzer/protocol/pia/PIA.cc b/src/analyzer/protocol/pia/PIA.cc
index 0d8f382dd9..0c3a1cfbcd 100644
--- a/src/analyzer/protocol/pia/PIA.cc
+++ b/src/analyzer/protocol/pia/PIA.cc
@@ -1,6 +1,10 @@
 #include "PIA.h"
 #include "RuleMatcher.h"
 #include "Event.h"
+#include "NetVar.h"
+#include "IP.h"
+#include "DebugLogger.h"
+#include "Reporter.h"
 #include "analyzer/protocol/tcp/TCP_Flags.h"
 #include "analyzer/protocol/tcp/TCP_Reassembler.h"
 
diff --git a/src/analyzer/protocol/pia/PIA.h b/src/analyzer/protocol/pia/PIA.h
index c0df3c32f2..467d353464 100644
--- a/src/analyzer/protocol/pia/PIA.h
+++ b/src/analyzer/protocol/pia/PIA.h
@@ -4,6 +4,7 @@
 
 #include "analyzer/Analyzer.h"
 #include "analyzer/protocol/tcp/TCP.h"
+#include "RuleMatcher.h"
 
 class RuleEndpointState;
 
diff --git a/src/analyzer/protocol/pia/Plugin.cc b/src/analyzer/protocol/pia/Plugin.cc
index c46e710f9d..617623d403 100644
--- a/src/analyzer/protocol/pia/Plugin.cc
+++ b/src/analyzer/protocol/pia/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "PIA.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_PIA {
diff --git a/src/analyzer/protocol/pop3/POP3.cc b/src/analyzer/protocol/pop3/POP3.cc
index 50ab3142dc..d0c5d0b3bd 100644
--- a/src/analyzer/protocol/pop3/POP3.cc
+++ b/src/analyzer/protocol/pop3/POP3.cc
@@ -2,19 +2,15 @@
 // Robin Sommer.
 
 #include "zeek-config.h"
+#include "POP3.h"
 
-#include <stdlib.h>
-#include <iostream>
 #include <vector>
 #include <string>
 #include <ctype.h>
 
-#include "NetVar.h"
-#include "POP3.h"
-#include "Event.h"
+#include "Base64.h"
 #include "Reporter.h"
 #include "analyzer/Manager.h"
-#include "analyzer/protocol/login/NVT.h"
 
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/pop3/Plugin.cc b/src/analyzer/protocol/pop3/Plugin.cc
index 0fed697e83..25311c928d 100644
--- a/src/analyzer/protocol/pop3/Plugin.cc
+++ b/src/analyzer/protocol/pop3/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "POP3.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_POP3 {
diff --git a/src/analyzer/protocol/radius/Plugin.cc b/src/analyzer/protocol/radius/Plugin.cc
index 8b6efe15b8..7ec57fe252 100644
--- a/src/analyzer/protocol/radius/Plugin.cc
+++ b/src/analyzer/protocol/radius/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "RADIUS.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_RADIUS {
diff --git a/src/analyzer/protocol/rdp/Plugin.cc b/src/analyzer/protocol/rdp/Plugin.cc
index 169c7501d6..324fbdccc8 100644
--- a/src/analyzer/protocol/rdp/Plugin.cc
+++ b/src/analyzer/protocol/rdp/Plugin.cc
@@ -1,6 +1,6 @@
-#include "plugin/Plugin.h"
-
 #include "RDP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_RDP {
diff --git a/src/analyzer/protocol/rdp/rdp-analyzer.pac b/src/analyzer/protocol/rdp/rdp-analyzer.pac
index dd76d07a87..73f68f29d2 100644
--- a/src/analyzer/protocol/rdp/rdp-analyzer.pac
+++ b/src/analyzer/protocol/rdp/rdp-analyzer.pac
@@ -1,4 +1,5 @@
 %extern{
+#include "Desc.h"
 #include "file_analysis/Manager.h"
 #include "types.bif.h"
 %}
diff --git a/src/analyzer/protocol/rfb/Plugin.cc b/src/analyzer/protocol/rfb/Plugin.cc
index 8cf53bb007..a195136aec 100644
--- a/src/analyzer/protocol/rfb/Plugin.cc
+++ b/src/analyzer/protocol/rfb/Plugin.cc
@@ -1,6 +1,6 @@
-#include "plugin/Plugin.h"
-
 #include "RFB.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_RFB {
diff --git a/src/analyzer/protocol/rpc/MOUNT.cc b/src/analyzer/protocol/rpc/MOUNT.cc
index 61117f2a51..b66bf34206 100644
--- a/src/analyzer/protocol/rpc/MOUNT.cc
+++ b/src/analyzer/protocol/rpc/MOUNT.cc
@@ -1,13 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek-config.h"
+#include "MOUNT.h"
+
 #include <algorithm>
 #include <vector>
 
-#include "zeek-config.h"
-
 #include "NetVar.h"
 #include "XDR.h"
-#include "MOUNT.h"
 #include "Event.h"
 
 #include "events.bif.h"
diff --git a/src/analyzer/protocol/rpc/MOUNT.h b/src/analyzer/protocol/rpc/MOUNT.h
index bb05bcd7cc..182922dfd4 100644
--- a/src/analyzer/protocol/rpc/MOUNT.h
+++ b/src/analyzer/protocol/rpc/MOUNT.h
@@ -3,8 +3,6 @@
 #pragma once
 
 #include "RPC.h"
-#include "XDR.h"
-#include "Event.h"
 
 namespace analyzer { namespace rpc {
 
diff --git a/src/analyzer/protocol/rpc/NFS.cc b/src/analyzer/protocol/rpc/NFS.cc
index c2764a1229..bba3375ec6 100644
--- a/src/analyzer/protocol/rpc/NFS.cc
+++ b/src/analyzer/protocol/rpc/NFS.cc
@@ -1,13 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <algorithm>
-#include <vector>
-
 #include "zeek-config.h"
+#include "NFS.h"
+
+#include <utility>
+#include <vector>
 
 #include "NetVar.h"
 #include "XDR.h"
-#include "NFS.h"
 #include "Event.h"
 
 #include "events.bif.h"
diff --git a/src/analyzer/protocol/rpc/NFS.h b/src/analyzer/protocol/rpc/NFS.h
index fecff7532b..8c4e259bd0 100644
--- a/src/analyzer/protocol/rpc/NFS.h
+++ b/src/analyzer/protocol/rpc/NFS.h
@@ -3,8 +3,7 @@
 #pragma once
 
 #include "RPC.h"
-#include "XDR.h"
-#include "Event.h"
+#include "NetVar.h"
 
 namespace analyzer { namespace rpc {
 
diff --git a/src/analyzer/protocol/rpc/Plugin.cc b/src/analyzer/protocol/rpc/Plugin.cc
index 2fff0ff6cf..1099553f0b 100644
--- a/src/analyzer/protocol/rpc/Plugin.cc
+++ b/src/analyzer/protocol/rpc/Plugin.cc
@@ -1,12 +1,11 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "RPC.h"
 #include "NFS.h"
 #include "MOUNT.h"
 #include "Portmap.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_RPC {
diff --git a/src/analyzer/protocol/rpc/Portmap.cc b/src/analyzer/protocol/rpc/Portmap.cc
index 7d80dd5f9b..d1dafc49c5 100644
--- a/src/analyzer/protocol/rpc/Portmap.cc
+++ b/src/analyzer/protocol/rpc/Portmap.cc
@@ -1,14 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "zeek-config.h"
-
+#include "Portmap.h"
 #include "NetVar.h"
 #include "XDR.h"
-#include "Portmap.h"
 #include "Event.h"
 
 #include "events.bif.h"
 
+#include "zeek-config.h"
+
 using namespace analyzer::rpc;
 
 #define PMAPPROC_NULL 0
diff --git a/src/analyzer/protocol/rpc/RPC.cc b/src/analyzer/protocol/rpc/RPC.cc
index 2820b5e033..9a87117435 100644
--- a/src/analyzer/protocol/rpc/RPC.cc
+++ b/src/analyzer/protocol/rpc/RPC.cc
@@ -1,18 +1,19 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <stdlib.h>
-
-#include <algorithm>
-
 #include "zeek-config.h"
+#include "RPC.h"
+
+#include <string>
 
 #include "NetVar.h"
 #include "XDR.h"
-#include "RPC.h"
+#include "Reporter.h"
 #include "Sessions.h"
 
 #include "events.bif.h"
 
+#include <stdlib.h>
+
 using namespace analyzer::rpc;
 
 namespace { // local namespace
diff --git a/src/analyzer/protocol/rpc/RPC.h b/src/analyzer/protocol/rpc/RPC.h
index 977272647b..b7a03ebac5 100644
--- a/src/analyzer/protocol/rpc/RPC.h
+++ b/src/analyzer/protocol/rpc/RPC.h
@@ -3,7 +3,7 @@
 #pragma once
 
 #include "analyzer/protocol/tcp/TCP.h"
-#include "analyzer/protocol/udp/UDP.h"
+#include "NetVar.h"
 
 namespace analyzer { namespace rpc {
 
diff --git a/src/analyzer/protocol/rpc/XDR.cc b/src/analyzer/protocol/rpc/XDR.cc
index 18776eee5f..95992d142c 100644
--- a/src/analyzer/protocol/rpc/XDR.cc
+++ b/src/analyzer/protocol/rpc/XDR.cc
@@ -1,12 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "zeek-config.h"
+#include "XDR.h"
+
 #include <string.h>
 #include <algorithm>
 
-#include "zeek-config.h"
-
-#include "XDR.h"
-
 #include "events.bif.h"
 
 using namespace analyzer::rpc;
diff --git a/src/analyzer/protocol/sip/Plugin.cc b/src/analyzer/protocol/sip/Plugin.cc
index 23ddebc12c..0f427c3a3a 100644
--- a/src/analyzer/protocol/sip/Plugin.cc
+++ b/src/analyzer/protocol/sip/Plugin.cc
@@ -1,10 +1,9 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "SIP.h"
 #include "SIP_TCP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_SIP {
diff --git a/src/analyzer/protocol/smtp/Plugin.cc b/src/analyzer/protocol/smtp/Plugin.cc
index 784da4d860..4a1a70c71e 100644
--- a/src/analyzer/protocol/smtp/Plugin.cc
+++ b/src/analyzer/protocol/smtp/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "SMTP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_SMTP {
diff --git a/src/analyzer/protocol/snmp/Plugin.cc b/src/analyzer/protocol/snmp/Plugin.cc
index d5c6e98309..f5ce06cde0 100644
--- a/src/analyzer/protocol/snmp/Plugin.cc
+++ b/src/analyzer/protocol/snmp/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "SNMP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_SNMP {
diff --git a/src/analyzer/protocol/snmp/SNMP.cc b/src/analyzer/protocol/snmp/SNMP.cc
index 2817bfec52..6e0988ae2b 100644
--- a/src/analyzer/protocol/snmp/SNMP.cc
+++ b/src/analyzer/protocol/snmp/SNMP.cc
@@ -2,6 +2,7 @@
 
 #include "SNMP.h"
 #include "Func.h"
+#include "Reporter.h"
 #include "types.bif.h"
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/snmp/snmp.pac b/src/analyzer/protocol/snmp/snmp.pac
index 29b9d32e73..33bdecf24a 100644
--- a/src/analyzer/protocol/snmp/snmp.pac
+++ b/src/analyzer/protocol/snmp/snmp.pac
@@ -2,6 +2,7 @@
 %include bro.pac
 
 %extern{
+#include "Reporter.h"
 #include "types.bif.h"
 #include "events.bif.h"
 %}
diff --git a/src/analyzer/protocol/socks/Plugin.cc b/src/analyzer/protocol/socks/Plugin.cc
index 8efbeeb23e..6e16935a26 100644
--- a/src/analyzer/protocol/socks/Plugin.cc
+++ b/src/analyzer/protocol/socks/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "SOCKS.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_SOCKS {
diff --git a/src/analyzer/protocol/socks/socks.pac b/src/analyzer/protocol/socks/socks.pac
index 9aed2820af..a6c4ad3605 100644
--- a/src/analyzer/protocol/socks/socks.pac
+++ b/src/analyzer/protocol/socks/socks.pac
@@ -3,6 +3,7 @@
 
 %extern{
 #include "SOCKS.h"
+#include "Reporter.h"
 
 #include "events.bif.h"
 %}
diff --git a/src/analyzer/protocol/ssh/Plugin.cc b/src/analyzer/protocol/ssh/Plugin.cc
index 7b6ac67c88..641bad8ab0 100644
--- a/src/analyzer/protocol/ssh/Plugin.cc
+++ b/src/analyzer/protocol/ssh/Plugin.cc
@@ -1,7 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
 #include "SSH.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 	namespace Zeek_SSH {
diff --git a/src/analyzer/protocol/ssl/Plugin.cc b/src/analyzer/protocol/ssl/Plugin.cc
index 60d6b0d4a3..8e67ddbee6 100644
--- a/src/analyzer/protocol/ssl/Plugin.cc
+++ b/src/analyzer/protocol/ssl/Plugin.cc
@@ -1,10 +1,9 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "SSL.h"
 #include "DTLS.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_SSL {
diff --git a/src/analyzer/protocol/ssl/functions.bif b/src/analyzer/protocol/ssl/functions.bif
index 17720bcbb1..6ca1a6f9a7 100644
--- a/src/analyzer/protocol/ssl/functions.bif
+++ b/src/analyzer/protocol/ssl/functions.bif
@@ -1,6 +1,7 @@
 
 %%{
 #include "analyzer/protocol/ssl/SSL.h"
+#include "Reporter.h"
 #include <openssl/x509.h>
 %%}
 
diff --git a/src/analyzer/protocol/ssl/ssl.pac b/src/analyzer/protocol/ssl/ssl.pac
index f7e7c17e7f..e7bf1bf23e 100644
--- a/src/analyzer/protocol/ssl/ssl.pac
+++ b/src/analyzer/protocol/ssl/ssl.pac
@@ -9,6 +9,7 @@
 %include bro.pac
 
 %extern{
+#include "Desc.h"
 #include "events.bif.h"
 
 namespace analyzer { namespace ssl { class SSL_Analyzer; } }
diff --git a/src/analyzer/protocol/ssl/tls-handshake.pac b/src/analyzer/protocol/ssl/tls-handshake.pac
index 3bc03eeddb..c545d1bc71 100644
--- a/src/analyzer/protocol/ssl/tls-handshake.pac
+++ b/src/analyzer/protocol/ssl/tls-handshake.pac
@@ -4,6 +4,7 @@
 %include bro.pac
 
 %extern{
+#include "Desc.h"
 #include "types.bif.h"
 #include "events.bif.h"
 %}
diff --git a/src/analyzer/protocol/stepping-stone/Plugin.cc b/src/analyzer/protocol/stepping-stone/Plugin.cc
index 5d76fa7d74..3152adc4c9 100644
--- a/src/analyzer/protocol/stepping-stone/Plugin.cc
+++ b/src/analyzer/protocol/stepping-stone/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "SteppingStone.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_SteppingStone {
diff --git a/src/analyzer/protocol/stepping-stone/SteppingStone.cc b/src/analyzer/protocol/stepping-stone/SteppingStone.cc
index f4055028f0..1d37e83815 100644
--- a/src/analyzer/protocol/stepping-stone/SteppingStone.cc
+++ b/src/analyzer/protocol/stepping-stone/SteppingStone.cc
@@ -1,6 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "SteppingStone.h"
 
 #include <stdlib.h>
 
@@ -8,9 +9,8 @@
 #include "Net.h"
 #include "NetVar.h"
 #include "analyzer/protocol/tcp/TCP.h"
-#include "SteppingStone.h"
+#include "Sessions.h"
 #include "util.h"
-
 #include "events.bif.h"
 
 using namespace analyzer::stepping_stone;
diff --git a/src/analyzer/protocol/syslog/Plugin.cc b/src/analyzer/protocol/syslog/Plugin.cc
index e4d5f38fa1..7e2501575b 100644
--- a/src/analyzer/protocol/syslog/Plugin.cc
+++ b/src/analyzer/protocol/syslog/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "Syslog.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_Syslog {
diff --git a/src/analyzer/protocol/tcp/ContentLine.cc b/src/analyzer/protocol/tcp/ContentLine.cc
index d98c5b4d2f..0c68e6ae2c 100644
--- a/src/analyzer/protocol/tcp/ContentLine.cc
+++ b/src/analyzer/protocol/tcp/ContentLine.cc
@@ -1,7 +1,6 @@
-#include <algorithm>
-
 #include "ContentLine.h"
-#include "analyzer/protocol/tcp/TCP.h"
+#include "TCP.h"
+#include "Reporter.h"
 
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/tcp/Plugin.cc b/src/analyzer/protocol/tcp/Plugin.cc
index 3a99b2036a..078d6bb3d9 100644
--- a/src/analyzer/protocol/tcp/Plugin.cc
+++ b/src/analyzer/protocol/tcp/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "TCP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_TCP {
diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc
index 543f767a2b..a19f425df3 100644
--- a/src/analyzer/protocol/tcp/TCP.cc
+++ b/src/analyzer/protocol/tcp/TCP.cc
@@ -1,14 +1,20 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <algorithm>
+#include "analyzer/protocol/tcp/TCP.h"
 
+#include <vector>
+
+#include "analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "analyzer/protocol/pia/PIA.h"
+
+#include "IP.h"
+#include "Net.h"
 #include "NetVar.h"
 #include "File.h"
 #include "Event.h"
-
-#include "analyzer/protocol/pia/PIA.h"
-#include "analyzer/protocol/tcp/TCP.h"
-#include "analyzer/protocol/tcp/TCP_Reassembler.h"
+#include "Reporter.h"
+#include "Sessions.h"
+#include "DebugLogger.h"
 
 #include "events.bif.h"
 #include "types.bif.h"
diff --git a/src/analyzer/protocol/tcp/TCP.h b/src/analyzer/protocol/tcp/TCP.h
index 1204f56916..02c783b730 100644
--- a/src/analyzer/protocol/tcp/TCP.h
+++ b/src/analyzer/protocol/tcp/TCP.h
@@ -3,7 +3,6 @@
 #pragma once
 
 #include "analyzer/Analyzer.h"
-#include "PacketDumper.h"
 #include "IPAddr.h"
 #include "TCP_Endpoint.h"
 #include "TCP_Flags.h"
diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.cc b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
index 47ed0a569f..fb3be41996 100644
--- a/src/analyzer/protocol/tcp/TCP_Endpoint.cc
+++ b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
@@ -4,6 +4,7 @@
 #include "NetVar.h"
 #include "analyzer/protocol/tcp/TCP.h"
 #include "TCP_Reassembler.h"
+#include "Reporter.h"
 #include "Sessions.h"
 #include "Event.h"
 #include "File.h"
diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.h b/src/analyzer/protocol/tcp/TCP_Endpoint.h
index 160ad335fa..60ec19a5da 100644
--- a/src/analyzer/protocol/tcp/TCP_Endpoint.h
+++ b/src/analyzer/protocol/tcp/TCP_Endpoint.h
@@ -4,6 +4,7 @@
 
 #include "IPAddr.h"
 
+class BroFile;
 class Connection;
 class IP_Hdr;
 
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.cc b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
index 5df1cc468a..28f4139225 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.cc
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
@@ -1,13 +1,15 @@
-#include <algorithm>
-
+#include "TCP_Reassembler.h"
+#include "TCP_Endpoint.h"
 #include "File.h"
 #include "analyzer/Analyzer.h"
-#include "TCP_Reassembler.h"
 #include "analyzer/protocol/tcp/TCP.h"
-#include "TCP_Endpoint.h"
+#include "Reporter.h"
+#include "RuleMatcher.h"
 
 #include "events.bif.h"
 
+#include <algorithm>
+
 using namespace analyzer::tcp;
 
 // Note, sequence numbers are relative. I.e., they start with 1.
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.h b/src/analyzer/protocol/tcp/TCP_Reassembler.h
index dd499e79cc..3137160f36 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.h
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.h
@@ -7,7 +7,11 @@
 class BroFile;
 class Connection;
 
-namespace analyzer { namespace tcp {
+namespace analyzer {
+
+class Analyzer;
+
+namespace tcp {
 
 class TCP_Analyzer;
 
diff --git a/src/analyzer/protocol/tcp/functions.bif b/src/analyzer/protocol/tcp/functions.bif
index af8a894137..5fb0216c89 100644
--- a/src/analyzer/protocol/tcp/functions.bif
+++ b/src/analyzer/protocol/tcp/functions.bif
@@ -1,6 +1,8 @@
 
 %%{
 #include "File.h"
+#include "Sessions.h"
+#include "Reporter.h"
 #include "analyzer/protocol/tcp/TCP.h"
 %%}
 
diff --git a/src/analyzer/protocol/teredo/Plugin.cc b/src/analyzer/protocol/teredo/Plugin.cc
index eeebea870d..0098066304 100644
--- a/src/analyzer/protocol/teredo/Plugin.cc
+++ b/src/analyzer/protocol/teredo/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "Teredo.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_Teredo {
diff --git a/src/analyzer/protocol/teredo/Teredo.cc b/src/analyzer/protocol/teredo/Teredo.cc
index adbbb9c964..1214f30e3b 100644
--- a/src/analyzer/protocol/teredo/Teredo.cc
+++ b/src/analyzer/protocol/teredo/Teredo.cc
@@ -4,6 +4,7 @@
 #include "Conn.h"
 #include "IP.h"
 #include "Reporter.h"
+#include "Sessions.h"
 
 #include "events.bif.h"
 
diff --git a/src/analyzer/protocol/udp/Plugin.cc b/src/analyzer/protocol/udp/Plugin.cc
index 9a42be6fa8..d94f898b31 100644
--- a/src/analyzer/protocol/udp/Plugin.cc
+++ b/src/analyzer/protocol/udp/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "analyzer/protocol/udp/UDP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_UDP {
diff --git a/src/analyzer/protocol/vxlan/Plugin.cc b/src/analyzer/protocol/vxlan/Plugin.cc
index 73c2cfd53b..2dee67952a 100644
--- a/src/analyzer/protocol/vxlan/Plugin.cc
+++ b/src/analyzer/protocol/vxlan/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "VXLAN.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_VXLAN {
diff --git a/src/analyzer/protocol/vxlan/VXLAN.cc b/src/analyzer/protocol/vxlan/VXLAN.cc
index f936ca4655..b7ed5322f7 100644
--- a/src/analyzer/protocol/vxlan/VXLAN.cc
+++ b/src/analyzer/protocol/vxlan/VXLAN.cc
@@ -6,10 +6,16 @@
 #include "TunnelEncapsulation.h"
 #include "Conn.h"
 #include "IP.h"
+#include "Net.h"
+#include "Sessions.h"
 #include "Reporter.h"
 
 #include "events.bif.h"
 
+extern "C" {
+#include <pcap.h>
+}
+
 using namespace analyzer::vxlan;
 
 void VXLAN_Analyzer::Done()
diff --git a/src/analyzer/protocol/vxlan/VXLAN.h b/src/analyzer/protocol/vxlan/VXLAN.h
index 62873959da..acc9accead 100644
--- a/src/analyzer/protocol/vxlan/VXLAN.h
+++ b/src/analyzer/protocol/vxlan/VXLAN.h
@@ -3,8 +3,6 @@
 #pragma once
 
 #include "analyzer/Analyzer.h"
-#include "NetVar.h"
-#include "Reporter.h"
 
 namespace analyzer { namespace vxlan {
 
diff --git a/src/analyzer/protocol/xmpp/Plugin.cc b/src/analyzer/protocol/xmpp/Plugin.cc
index 92165e3d99..cd8eb16391 100644
--- a/src/analyzer/protocol/xmpp/Plugin.cc
+++ b/src/analyzer/protocol/xmpp/Plugin.cc
@@ -1,7 +1,8 @@
 // See the file  in the main distribution directory for copyright.
-#include "plugin/Plugin.h"
 
 #include "XMPP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_XMPP {
diff --git a/src/analyzer/protocol/xmpp/xmpp.pac b/src/analyzer/protocol/xmpp/xmpp.pac
index e6b5f4bba0..79e5159914 100644
--- a/src/analyzer/protocol/xmpp/xmpp.pac
+++ b/src/analyzer/protocol/xmpp/xmpp.pac
@@ -8,6 +8,7 @@
 
 
 %extern{
+#include "Reporter.h"
 #include "events.bif.h"
 
 namespace analyzer { namespace xmpp { class XMPP_Analyzer; } }
diff --git a/src/analyzer/protocol/zip/Plugin.cc b/src/analyzer/protocol/zip/Plugin.cc
index f81576e1bb..2f00193ddd 100644
--- a/src/analyzer/protocol/zip/Plugin.cc
+++ b/src/analyzer/protocol/zip/Plugin.cc
@@ -1,9 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "ZIP.h"
+#include "plugin/Plugin.h"
+#include "analyzer/Component.h"
 
 namespace plugin {
 namespace Zeek_ZIP {
diff --git a/src/binpac_bro.h b/src/binpac_bro.h
index be525ee918..1db3f0d3b8 100644
--- a/src/binpac_bro.h
+++ b/src/binpac_bro.h
@@ -9,10 +9,8 @@ namespace analyzer { class Analyzer; }
 #include "util.h"
 #include "Val.h"
 #include "event.bif.func_h"
-#include "TunnelEncapsulation.h"
 #include "analyzer/Analyzer.h"
 #include "file_analysis/Analyzer.h"
-#include "Conn.h"
 
 #include "binpac.h"
 
diff --git a/src/bro-bif.h b/src/bro-bif.h
index 0853647af8..a20996152b 100644
--- a/src/bro-bif.h
+++ b/src/bro-bif.h
@@ -6,3 +6,5 @@
 #include "Conn.h"
 #include "NetVar.h"
 #include "Event.h"
+#include "Reporter.h"
+#include "Var.h" // for internal_type()
diff --git a/src/broker/Data.cc b/src/broker/Data.cc
index 0929961dc8..dd231e44d0 100644
--- a/src/broker/Data.cc
+++ b/src/broker/Data.cc
@@ -1,5 +1,8 @@
 #include "Data.h"
 #include "File.h"
+#include "Desc.h"
+#include "IntrusivePtr.h"
+#include "module_util.h"
 #include "3rdparty/doctest.h"
 #include "broker/data.bif.h"
 
@@ -1148,6 +1151,13 @@ broker::data& bro_broker::opaque_field_to_data(RecordVal* v, Frame* f)
 	return static_cast<DataVal*>(d)->data;
 	}
 
+void bro_broker::DataVal::ValDescribe(ODesc* d) const
+	{
+	d->Add("broker::data{");
+	d->Add(broker::to_string(data));
+	d->Add("}");
+	}
+
 bool bro_broker::DataVal::canCastTo(BroType* t) const
 	{
 	return data_type_check(data, t);
diff --git a/src/broker/Data.h b/src/broker/Data.h
index fa7ca89400..5e8b9cc0fd 100644
--- a/src/broker/Data.h
+++ b/src/broker/Data.h
@@ -1,13 +1,15 @@
 #pragma once
 
-#include <broker/data.hh>
-#include <broker/expected.hh>
-
 #include "OpaqueVal.h"
 #include "Reporter.h"
 #include "Frame.h"
 #include "Expr.h"
-#include "IntrusivePtr.h"
+#include "Var.h" // for internal_type()
+
+template <class T>
+class IntrusivePtr;
+
+class ODesc;
 
 namespace bro_broker {
 
@@ -101,12 +103,7 @@ public:
 		: OpaqueVal(bro_broker::opaque_of_data_type), data(std::move(arg_data))
 		{}
 
-	void ValDescribe(ODesc* d) const override
-		{
-		d->Add("broker::data{");
-		d->Add(broker::to_string(data));
-		d->Add("}");
-		}
+	void ValDescribe(ODesc* d) const override;
 
 	IntrusivePtr<Val> castTo(BroType* t);
 	bool canCastTo(BroType* t) const;
diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc
index 1e54ce33a0..129f6ad525 100644
--- a/src/broker/Manager.cc
+++ b/src/broker/Manager.cc
@@ -1,3 +1,4 @@
+#include "Manager.h"
 
 #include <broker/broker.hh>
 #include <broker/zeek.hh>
@@ -5,12 +6,13 @@
 #include <cstring>
 #include <unistd.h>
 
-#include "Manager.h"
 #include "Data.h"
 #include "Store.h"
 #include "util.h"
 #include "Var.h"
+#include "Desc.h"
 #include "Reporter.h"
+#include "IntrusivePtr.h"
 #include "broker/comm.bif.h"
 #include "broker/data.bif.h"
 #include "broker/messaging.bif.h"
@@ -19,6 +21,7 @@
 #include "DebugLogger.h"
 #include "iosource/Manager.h"
 #include "SerializationFormat.h"
+#include "Net.h"
 
 using namespace std;
 
diff --git a/src/broker/Manager.h b/src/broker/Manager.h
index 43698a22d3..5f98177a09 100644
--- a/src/broker/Manager.h
+++ b/src/broker/Manager.h
@@ -12,20 +12,21 @@
 #include <broker/backend_options.hh>
 #include <broker/detail/hash.hh>
 #include <broker/zeek.hh>
+
 #include <memory>
 #include <string>
-#include <map>
-#include <set>
 #include <unordered_map>
-#include <unordered_set>
-#include "broker/Store.h"
-#include "Reporter.h"
+
+#include "NetVar.h"
 #include "iosource/IOSource.h"
-#include "Val.h"
 #include "logging/WriterBackend.h"
 
+class Frame;
+
 namespace bro_broker {
 
+class StoreHandleVal;
+class StoreQueryCallback;
 class BrokerState;
 
 /**
diff --git a/src/broker/Store.cc b/src/broker/Store.cc
index 2f61b14d37..20020375eb 100644
--- a/src/broker/Store.cc
+++ b/src/broker/Store.cc
@@ -1,4 +1,5 @@
 #include "Store.h"
+#include "Desc.h"
 #include "broker/Manager.h"
 
 namespace bro_broker {
diff --git a/src/broker/Store.h b/src/broker/Store.h
index 0ba3d2ad5d..fd8f0911d5 100644
--- a/src/broker/Store.h
+++ b/src/broker/Store.h
@@ -2,8 +2,8 @@
 
 #include "broker/store.bif.h"
 #include "broker/data.bif.h"
-#include "Reporter.h"
 #include "Type.h"
+#include "Var.h" // for internal_type()
 #include "OpaqueVal.h"
 #include "Trigger.h"
 
diff --git a/src/file_analysis/Component.h b/src/file_analysis/Component.h
index a4aee3d5eb..e63a4db248 100644
--- a/src/file_analysis/Component.h
+++ b/src/file_analysis/Component.h
@@ -6,10 +6,9 @@
 #include "plugin/Component.h"
 #include "plugin/TaggedComponent.h"
 
-#include "Val.h"
-
 #include "../zeek-config.h"
-#include "../util.h"
+
+class RecordVal;
 
 namespace file_analysis {
 
diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc
index 1367d69196..131bb7cbef 100644
--- a/src/file_analysis/File.cc
+++ b/src/file_analysis/File.cc
@@ -1,9 +1,10 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <string>
-#include <algorithm>
-
 #include "File.h"
+
+#include <utility>
+
+#include "FileReassembler.h"
 #include "FileTimer.h"
 #include "Analyzer.h"
 #include "Manager.h"
diff --git a/src/file_analysis/File.h b/src/file_analysis/File.h
index 94a15ae039..058de9f153 100644
--- a/src/file_analysis/File.h
+++ b/src/file_analysis/File.h
@@ -4,19 +4,20 @@
 
 #include <string>
 #include <utility>
-#include <vector>
 
-#include "FileReassembler.h"
-#include "Conn.h"
-#include "Val.h"
-#include "Tag.h"
 #include "AnalyzerSet.h"
 #include "BroString.h"
 #include "WeirdState.h"
 
+using std::string;
+
+class Connection;
+class RecordVal;
+
 namespace file_analysis {
 
 class FileReassembler;
+class Tag;
 
 /**
  * Wrapper class around \c fa_file record values from script layer.
diff --git a/src/file_analysis/FileReassembler.h b/src/file_analysis/FileReassembler.h
index 287ebd8d22..caaa1d443a 100644
--- a/src/file_analysis/FileReassembler.h
+++ b/src/file_analysis/FileReassembler.h
@@ -1,7 +1,6 @@
 #pragma once
 
 #include "Reassem.h"
-#include "File.h"
 
 class BroFile;
 class Connection;
diff --git a/src/file_analysis/FileTimer.cc b/src/file_analysis/FileTimer.cc
index 40237ebb54..015915c36b 100644
--- a/src/file_analysis/FileTimer.cc
+++ b/src/file_analysis/FileTimer.cc
@@ -1,7 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "Manager.h"
+#include "FileTimer.h"
 #include "File.h"
+#include "Manager.h"
 
 using namespace file_analysis;
 
diff --git a/src/file_analysis/FileTimer.h b/src/file_analysis/FileTimer.h
index 1ccadee1f3..32ddd4fb9c 100644
--- a/src/file_analysis/FileTimer.h
+++ b/src/file_analysis/FileTimer.h
@@ -2,9 +2,12 @@
 
 #pragma once
 
-#include <string>
 #include "Timer.h"
 
+#include <string>
+
+using std::string;
+
 namespace file_analysis {
 
 /**
diff --git a/src/file_analysis/Manager.cc b/src/file_analysis/Manager.cc
index 29cb492acc..9c7f87d8b5 100644
--- a/src/file_analysis/Manager.cc
+++ b/src/file_analysis/Manager.cc
@@ -1,9 +1,5 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <vector>
-#include <string>
-#include <openssl/md5.h>
-
 #include "Manager.h"
 #include "File.h"
 #include "Analyzer.h"
@@ -15,6 +11,8 @@
 #include "plugin/Manager.h"
 #include "analyzer/Manager.h"
 
+#include <openssl/md5.h>
+
 using namespace file_analysis;
 
 TableVal* Manager::disabled = 0;
diff --git a/src/file_analysis/Manager.h b/src/file_analysis/Manager.h
index 870d8e9d4e..37c48402b5 100644
--- a/src/file_analysis/Manager.h
+++ b/src/file_analysis/Manager.h
@@ -6,26 +6,30 @@
 #include <set>
 #include <map>
 
-#include "Dict.h"
+#include "Component.h"
 #include "Net.h"
-#include "Conn.h"
-#include "Val.h"
-#include "Analyzer.h"
-#include "Timer.h"
-#include "EventHandler.h"
 #include "RuleMatcher.h"
 
-#include "File.h"
-#include "FileTimer.h"
-#include "Component.h"
-#include "Tag.h"
 #include "plugin/ComponentManager.h"
-#include "analyzer/Tag.h"
 
 #include "file_analysis/file_analysis.bif.h"
 
+using std::map;
+using std::set;
+
+class TableVal;
+class VectorVal;
+
+namespace analyzer {
+class Analyzer;
+class Tag;
+}
+
 namespace file_analysis {
 
+class File;
+class Tag;
+
 /**
  * Main entry point for interacting with file analysis.
  */
diff --git a/src/file_analysis/Tag.h b/src/file_analysis/Tag.h
index 92100a2e69..6f5dae6b03 100644
--- a/src/file_analysis/Tag.h
+++ b/src/file_analysis/Tag.h
@@ -3,13 +3,17 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "util.h"
 #include "../Tag.h"
-#include "plugin/TaggedComponent.h"
-#include "plugin/ComponentManager.h"
 
 class EnumVal;
 
+namespace plugin {
+template <class T>
+class TaggedComponent;
+template <class T, class C>
+class ComponentManager;
+}
+
 namespace file_analysis {
 
 class Component;
diff --git a/src/file_analysis/analyzer/data_event/Plugin.cc b/src/file_analysis/analyzer/data_event/Plugin.cc
index b41d2356a7..14eefac2e3 100644
--- a/src/file_analysis/analyzer/data_event/Plugin.cc
+++ b/src/file_analysis/analyzer/data_event/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "DataEvent.h"
+#include "plugin/Plugin.h"
+#include "file_analysis/Component.h"
 
 namespace plugin {
 namespace Zeek_FileDataEvent {
diff --git a/src/file_analysis/analyzer/entropy/Plugin.cc b/src/file_analysis/analyzer/entropy/Plugin.cc
index a4ae3416cd..6ac3dffd56 100644
--- a/src/file_analysis/analyzer/entropy/Plugin.cc
+++ b/src/file_analysis/analyzer/entropy/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "Entropy.h"
+#include "plugin/Plugin.h"
+#include "file_analysis/Component.h"
 
 namespace plugin {
 namespace Zeek_FileEntropy {
diff --git a/src/file_analysis/analyzer/extract/Plugin.cc b/src/file_analysis/analyzer/extract/Plugin.cc
index be8c44eaac..dc7107d858 100644
--- a/src/file_analysis/analyzer/extract/Plugin.cc
+++ b/src/file_analysis/analyzer/extract/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "Extract.h"
+#include "plugin/Plugin.h"
+#include "file_analysis/Component.h"
 
 namespace plugin {
 namespace Zeek_FileExtract {
diff --git a/src/file_analysis/analyzer/hash/Plugin.cc b/src/file_analysis/analyzer/hash/Plugin.cc
index 774e51511e..9e11ee3832 100644
--- a/src/file_analysis/analyzer/hash/Plugin.cc
+++ b/src/file_analysis/analyzer/hash/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "Hash.h"
+#include "plugin/Plugin.h"
+#include "file_analysis/Component.h"
 
 namespace plugin {
 namespace Zeek_FileHash {
diff --git a/src/file_analysis/analyzer/pe/Plugin.cc b/src/file_analysis/analyzer/pe/Plugin.cc
index 08a255785e..0b4ae65a12 100644
--- a/src/file_analysis/analyzer/pe/Plugin.cc
+++ b/src/file_analysis/analyzer/pe/Plugin.cc
@@ -1,8 +1,8 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "PE.h"
+#include "plugin/Plugin.h"
+#include "file_analysis/Component.h"
 
 namespace plugin {
 namespace Zeek_PE {
diff --git a/src/file_analysis/analyzer/unified2/Plugin.cc b/src/file_analysis/analyzer/unified2/Plugin.cc
index 2fef6e5dfa..dba2fb0b46 100644
--- a/src/file_analysis/analyzer/unified2/Plugin.cc
+++ b/src/file_analysis/analyzer/unified2/Plugin.cc
@@ -2,9 +2,9 @@
 
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "Unified2.h"
+#include "plugin/Plugin.h"
+#include "file_analysis/Component.h"
 
 namespace plugin {
 namespace Zeek_Unified2 {
diff --git a/src/file_analysis/analyzer/x509/OCSP.cc b/src/file_analysis/analyzer/x509/OCSP.cc
index 8f5ed3419c..dd7d378f0d 100644
--- a/src/file_analysis/analyzer/x509/OCSP.cc
+++ b/src/file_analysis/analyzer/x509/OCSP.cc
@@ -5,6 +5,7 @@
 #include "OCSP.h"
 #include "X509.h"
 #include "Event.h"
+#include "Reporter.h"
 
 #include "types.bif.h"
 #include "ocsp_events.bif.h"
diff --git a/src/file_analysis/analyzer/x509/Plugin.cc b/src/file_analysis/analyzer/x509/Plugin.cc
index 2f495e6337..221816fca5 100644
--- a/src/file_analysis/analyzer/x509/Plugin.cc
+++ b/src/file_analysis/analyzer/x509/Plugin.cc
@@ -1,10 +1,9 @@
 // See the file  in the main distribution directory for copyright.
 
-
-#include "plugin/Plugin.h"
-
 #include "X509.h"
 #include "OCSP.h"
+#include "plugin/Plugin.h"
+#include "file_analysis/Component.h"
 
 namespace plugin {
 namespace Zeek_X509 {
diff --git a/src/file_analysis/analyzer/x509/X509Common.cc b/src/file_analysis/analyzer/x509/X509Common.cc
index 7fb3100e97..a14e73085a 100644
--- a/src/file_analysis/analyzer/x509/X509Common.cc
+++ b/src/file_analysis/analyzer/x509/X509Common.cc
@@ -2,6 +2,7 @@
 
 #include "X509Common.h"
 #include "x509-extension_pac.h"
+#include "Reporter.h"
 
 #include "events.bif.h"
 #include "ocsp_events.bif.h"
diff --git a/src/file_analysis/analyzer/x509/X509Common.h b/src/file_analysis/analyzer/x509/X509Common.h
index fe56e0b9a8..019433a47a 100644
--- a/src/file_analysis/analyzer/x509/X509Common.h
+++ b/src/file_analysis/analyzer/x509/X509Common.h
@@ -11,6 +11,8 @@
 #include <openssl/x509.h>
 #include <openssl/asn1.h>
 
+class Reporter;
+
 namespace file_analysis {
 
 class X509Common : public file_analysis::Analyzer {
diff --git a/src/file_analysis/file_analysis.bif b/src/file_analysis/file_analysis.bif
index f3086041b0..d85d8cdb5a 100644
--- a/src/file_analysis/file_analysis.bif
+++ b/src/file_analysis/file_analysis.bif
@@ -4,6 +4,8 @@ module Files;
 
 %%{
 #include "file_analysis/Manager.h"
+#include "file_analysis/File.h"
+#include "Reporter.h"
 %%}
 
 type AnalyzerArgs: record;
diff --git a/src/input/Manager.cc b/src/input/Manager.cc
index cbfa4086d9..53981e589f 100644
--- a/src/input/Manager.cc
+++ b/src/input/Manager.cc
@@ -1,12 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <algorithm>
-
 #include "Manager.h"
+
+#include <string>
+#include <utility>
+
 #include "ReaderFrontend.h"
 #include "ReaderBackend.h"
+#include "Desc.h"
+#include "module_util.h"
 #include "input.bif.h"
 
+#include "Expr.h"
 #include "Event.h"
 #include "EventHandler.h"
 #include "NetVar.h"
diff --git a/src/input/Manager.h b/src/input/Manager.h
index 2cdfb9e192..69e3c2964d 100644
--- a/src/input/Manager.h
+++ b/src/input/Manager.h
@@ -4,14 +4,16 @@
 
 #pragma once
 
-#include "BroString.h"
-#include "EventHandler.h"
-#include "Val.h"
-
 #include "Component.h"
+#include "EventHandler.h"
+#include "plugin/ComponentManager.h"
+#include "threading/SerialTypes.h"
+#include "Tag.h"
 
 #include <map>
 
+class RecordVal;
+
 namespace input {
 
 class ReaderFrontend;
diff --git a/src/input/ReaderFrontend.cc b/src/input/ReaderFrontend.cc
index 3852a1002a..09e9dba456 100644
--- a/src/input/ReaderFrontend.cc
+++ b/src/input/ReaderFrontend.cc
@@ -4,8 +4,6 @@
 #include "ReaderFrontend.h"
 #include "ReaderBackend.h"
 
-#include "threading/MsgThread.h"
-
 namespace input {
 
 class InitMessage : public threading::InputMessage<ReaderBackend>
diff --git a/src/input/ReaderFrontend.h b/src/input/ReaderFrontend.h
index c9f597eb74..9a30995ada 100644
--- a/src/input/ReaderFrontend.h
+++ b/src/input/ReaderFrontend.h
@@ -3,10 +3,9 @@
 #pragma once
 
 #include "ReaderBackend.h"
-#include "threading/MsgThread.h"
 #include "threading/SerialTypes.h"
 
-#include "Val.h"
+class EnumVal;
 
 namespace input {
 
diff --git a/src/input/Tag.h b/src/input/Tag.h
index 42f24a0345..86f85ac36b 100644
--- a/src/input/Tag.h
+++ b/src/input/Tag.h
@@ -3,13 +3,17 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "util.h"
 #include "../Tag.h"
-#include "plugin/TaggedComponent.h"
-#include "plugin/ComponentManager.h"
 
 class EnumVal;
 
+namespace plugin {
+template <class T>
+class TaggedComponent;
+template <class T, class C>
+class ComponentManager;
+}
+
 namespace input {
 
 class Manager;
diff --git a/src/iosource/BPF_Program.cc b/src/iosource/BPF_Program.cc
index a99acd07e4..8a97a6fc25 100644
--- a/src/iosource/BPF_Program.cc
+++ b/src/iosource/BPF_Program.cc
@@ -2,9 +2,10 @@
 
 #include "zeek-config.h"
 
-#include "util.h"
 #include "BPF_Program.h"
 
+#include <string.h>
+
 #ifdef DONT_HAVE_LIBPCAP_PCAP_FREECODE
 extern "C" {
 #include "pcap-int.h"
diff --git a/src/iosource/BPF_Program.h b/src/iosource/BPF_Program.h
index 4823b7c9b4..de06e9d13a 100644
--- a/src/iosource/BPF_Program.h
+++ b/src/iosource/BPF_Program.h
@@ -6,7 +6,7 @@ extern "C" {
 #include <pcap.h>
 }
 
-#include "util.h"
+#include <stdint.h>
 
 // BPF_Programs are an abstraction around struct bpf_program,
 // to create a clean facility for creating, compiling, and
diff --git a/src/iosource/Component.h b/src/iosource/Component.h
index cf072feb36..9d8367ac0a 100644
--- a/src/iosource/Component.h
+++ b/src/iosource/Component.h
@@ -2,11 +2,11 @@
 
 #pragma once
 
+#include "plugin/Component.h"
+
 #include <string>
 #include <vector>
 
-#include "plugin/Component.h"
-
 namespace iosource {
 
 class IOSource;
diff --git a/src/iosource/IOSource.h b/src/iosource/IOSource.h
index cc8cf6a97f..ea218a675b 100644
--- a/src/iosource/IOSource.h
+++ b/src/iosource/IOSource.h
@@ -2,12 +2,6 @@
 
 #pragma once
 
-extern "C" {
-#include <pcap.h>
-}
-
-#include <string>
-
 namespace iosource {
 
 /**
diff --git a/src/iosource/Manager.cc b/src/iosource/Manager.cc
index b93bb03c60..ded3348040 100644
--- a/src/iosource/Manager.cc
+++ b/src/iosource/Manager.cc
@@ -1,12 +1,14 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <sys/types.h>
+
 #include <sys/event.h>
+#include <sys/types.h>
 #include <sys/time.h>
 #include <unistd.h>
 #include <assert.h>
 
 #include "Manager.h"
+#include "Component.h"
 #include "IOSource.h"
 #include "Net.h"
 #include "PktSrc.h"
diff --git a/src/iosource/Manager.h b/src/iosource/Manager.h
index 1cd8eb965d..2b0f4bec9a 100644
--- a/src/iosource/Manager.h
+++ b/src/iosource/Manager.h
@@ -11,6 +11,9 @@
 #include "IOSource.h"
 #include "Flare.h"
 
+struct timespec;
+struct kevent;
+
 namespace iosource {
 
 class PktSrc;
diff --git a/src/iosource/Packet.cc b/src/iosource/Packet.cc
index 648aef3b6e..49d0cf35b0 100644
--- a/src/iosource/Packet.cc
+++ b/src/iosource/Packet.cc
@@ -1,9 +1,11 @@
-
 #include "Packet.h"
 #include "Sessions.h"
+#include "Desc.h"
+#include "IP.h"
 #include "iosource/Manager.h"
 
 extern "C" {
+#include <pcap.h>
 #ifdef HAVE_NET_ETHERNET_H
 #include <net/ethernet.h>
 #elif defined(HAVE_SYS_ETHERNET_H)
@@ -60,6 +62,11 @@ void Packet::Init(int arg_link_type, pkt_timeval *arg_ts, uint32_t arg_caplen,
 		ProcessLayer2();
 	}
 
+const IP_Hdr Packet::IP() const
+	{
+	return IP_Hdr((struct ip *) (data + hdr_size), false);
+	}
+
 void Packet::Weird(const char* name)
 	{
 	sessions->Weird(name, this);
diff --git a/src/iosource/Packet.h b/src/iosource/Packet.h
index 0a0995f944..79e82c3227 100644
--- a/src/iosource/Packet.h
+++ b/src/iosource/Packet.h
@@ -1,8 +1,9 @@
 #pragma once
 
-#include "Desc.h"
-#include "IP.h"
-#include "NetVar.h"
+#include <string>
+
+#include <stdint.h>
+#include <sys/types.h> // for u_char
 
 #if defined(__OpenBSD__)
 #include <net/bpf.h>
@@ -11,6 +12,11 @@ typedef struct bpf_timeval pkt_timeval;
 typedef struct timeval pkt_timeval;
 #endif
 
+class Val;
+class ODesc;
+class IP_Hdr;
+class RecordVal;
+
 /**
  * The Layer 3 type of a packet, as determined by the parsing code in Packet.
  */
@@ -113,8 +119,7 @@ public:
 	 * Interprets the Layer 3 of the packet as IP and returns a
 	 * correspondign object.
 	 */
-	const IP_Hdr IP() const
-		{ return IP_Hdr((struct ip *) (data + hdr_size), false); }
+	const IP_Hdr IP() const;
 
 	/**
 	 * Returns a \c raw_pkt_hdr RecordVal, which includes layer 2 and
diff --git a/src/iosource/PktDumper.cc b/src/iosource/PktDumper.cc
index 863c46ec81..9a49ccb6fb 100644
--- a/src/iosource/PktDumper.cc
+++ b/src/iosource/PktDumper.cc
@@ -1,12 +1,10 @@
 
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <errno.h>
-#include <sys/stat.h>
-
 #include "zeek-config.h"
 
 #include "PktDumper.h"
+#include "DebugLogger.h"
 
 using namespace iosource;
 
diff --git a/src/iosource/PktDumper.h b/src/iosource/PktDumper.h
index 2b6251ba0a..406e90ffc2 100644
--- a/src/iosource/PktDumper.h
+++ b/src/iosource/PktDumper.h
@@ -2,8 +2,9 @@
 
 #pragma once
 
-#include "Packet.h"
-#include "IOSource.h"
+#include <string>
+
+class Packet;
 
 namespace iosource {
 
diff --git a/src/iosource/PktSrc.cc b/src/iosource/PktSrc.cc
index 16eaf5aec7..19bf1f3f52 100644
--- a/src/iosource/PktSrc.cc
+++ b/src/iosource/PktSrc.cc
@@ -1,17 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <errno.h>
+#include "zeek-config.h"
+#include "PktSrc.h"
+
 #include <sys/stat.h>
 
-#include "zeek-config.h"
-
 #include "util.h"
-#include "PktSrc.h"
 #include "Hash.h"
 #include "Net.h"
 #include "Sessions.h"
 #include "broker/Manager.h"
 #include "iosource/Manager.h"
+#include "BPF_Program.h"
 
 #include "pcap/pcap.bif.h"
 
diff --git a/src/iosource/PktSrc.h b/src/iosource/PktSrc.h
index 8207e030e9..bbb7c4a830 100644
--- a/src/iosource/PktSrc.h
+++ b/src/iosource/PktSrc.h
@@ -5,10 +5,13 @@
 #include <vector>
 
 #include "IOSource.h"
-#include "BPF_Program.h"
-#include "Dict.h"
 #include "Packet.h"
 
+#include <sys/types.h> // for u_char
+
+struct pcap_pkthdr;
+class BPF_Program;
+
 namespace iosource {
 
 /**
diff --git a/src/iosource/pcap/Plugin.cc b/src/iosource/pcap/Plugin.cc
index 75f8f54a2c..4aec5bd4cd 100644
--- a/src/iosource/pcap/Plugin.cc
+++ b/src/iosource/pcap/Plugin.cc
@@ -1,9 +1,9 @@
 // See the file  in the main distribution directory for copyright.
 
-#include "plugin/Plugin.h"
-
 #include "Source.h"
 #include "Dumper.h"
+#include "plugin/Plugin.h"
+#include "iosource/Component.h"
 
 namespace plugin {
 namespace Zeek_Pcap {
diff --git a/src/iosource/pcap/Source.cc b/src/iosource/pcap/Source.cc
index 47df453ff0..eb13b4d024 100644
--- a/src/iosource/pcap/Source.cc
+++ b/src/iosource/pcap/Source.cc
@@ -1,11 +1,10 @@
 // See the file  in the main distribution directory for copyright.
 
-#include <assert.h>
-
 #include "zeek-config.h"
 
 #include "Source.h"
 #include "iosource/Packet.h"
+#include "iosource/BPF_Program.h"
 
 #include "pcap.bif.h"
 
diff --git a/src/iosource/pcap/Source.h b/src/iosource/pcap/Source.h
index df57d6612d..fd2fa0ec53 100644
--- a/src/iosource/pcap/Source.h
+++ b/src/iosource/pcap/Source.h
@@ -4,6 +4,12 @@
 
 #include "../PktSrc.h"
 
+extern "C" {
+#include <pcap.h>
+}
+
+#include <sys/types.h> // for u_char
+
 namespace iosource {
 namespace pcap {
 
diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc
index a5ed5e3c35..0b92c911b9 100644
--- a/src/logging/Manager.cc
+++ b/src/logging/Manager.cc
@@ -1,6 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <algorithm>
+#include "Manager.h"
+
+#include <utility>
 
 #include "Event.h"
 #include "EventHandler.h"
@@ -8,18 +10,21 @@
 #include "Net.h"
 #include "Type.h"
 #include "File.h"
+#include "input.h"
 
 #include "broker/Manager.h"
 #include "threading/Manager.h"
 #include "threading/SerialTypes.h"
 
-#include "Manager.h"
+#include "Desc.h"
 #include "WriterFrontend.h"
 #include "WriterBackend.h"
 #include "logging.bif.h"
 #include "plugin/Plugin.h"
 #include "plugin/Manager.h"
 
+#include <broker/endpoint_info.hh>
+
 using namespace logging;
 
 struct Manager::Filter {
diff --git a/src/logging/Manager.h b/src/logging/Manager.h
index 06c551e8ed..2d6a9728c3 100644
--- a/src/logging/Manager.h
+++ b/src/logging/Manager.h
@@ -4,8 +4,6 @@
 
 #pragma once
 
-#include <broker/endpoint_info.hh>
-
 #include "../Val.h"
 #include "../Tag.h"
 #include "../EventHandler.h"
@@ -14,6 +12,7 @@
 #include "Component.h"
 #include "WriterBackend.h"
 
+namespace broker { struct endpoint_info; }
 class SerializationFormat;
 class RotationTimer;
 
diff --git a/src/logging/Tag.h b/src/logging/Tag.h
index d37561dd91..40a7b40b5f 100644
--- a/src/logging/Tag.h
+++ b/src/logging/Tag.h
@@ -3,13 +3,17 @@
 #pragma once
 
 #include "zeek-config.h"
-#include "util.h"
 #include "../Tag.h"
-#include "plugin/TaggedComponent.h"
-#include "plugin/ComponentManager.h"
 
 class EnumVal;
 
+namespace plugin {
+template <class T>
+class TaggedComponent;
+template <class T, class C>
+class ComponentManager;
+}
+
 namespace logging {
 
 class Manager;
diff --git a/src/logging/WriterFrontend.h b/src/logging/WriterFrontend.h
index b202621ec6..9a78ecf7db 100644
--- a/src/logging/WriterFrontend.h
+++ b/src/logging/WriterFrontend.h
@@ -4,8 +4,6 @@
 
 #include "WriterBackend.h"
 
-#include "threading/MsgThread.h"
-
 namespace logging  {
 
 class Manager;
diff --git a/src/logging/writers/ascii/Ascii.h b/src/logging/writers/ascii/Ascii.h
index 721ba95e20..875216b880 100644
--- a/src/logging/writers/ascii/Ascii.h
+++ b/src/logging/writers/ascii/Ascii.h
@@ -7,6 +7,7 @@
 #include "logging/WriterBackend.h"
 #include "threading/formatters/Ascii.h"
 #include "threading/formatters/JSON.h"
+#include "Desc.h"
 #include "zlib.h"
 
 namespace logging { namespace writer {
diff --git a/src/logging/writers/none/None.cc b/src/logging/writers/none/None.cc
index 0bd507e1f8..5691430476 100644
--- a/src/logging/writers/none/None.cc
+++ b/src/logging/writers/none/None.cc
@@ -4,6 +4,8 @@
 #include "None.h"
 #include "none.bif.h"
 
+#include <iostream>
+
 using namespace logging;
 using namespace writer;
 
diff --git a/src/logging/writers/sqlite/SQLite.h b/src/logging/writers/sqlite/SQLite.h
index b45357015d..87003f35cb 100644
--- a/src/logging/writers/sqlite/SQLite.h
+++ b/src/logging/writers/sqlite/SQLite.h
@@ -9,6 +9,7 @@
 #include "logging/WriterBackend.h"
 #include "threading/formatters/Ascii.h"
 #include "3rdparty/sqlite3.h"
+#include "Desc.h"
 
 namespace logging { namespace writer {
 
diff --git a/src/main.cc b/src/main.cc
index c4fae32fb4..344218331a 100644
--- a/src/main.cc
+++ b/src/main.cc
@@ -33,6 +33,7 @@ extern "C" {
 #include "Var.h"
 #include "Timer.h"
 #include "Stmt.h"
+#include "Desc.h"
 #include "Debug.h"
 #include "DFA.h"
 #include "RuleMatcher.h"
diff --git a/src/parse.y b/src/parse.y
index 4487998c5d..bb9e3ba82d 100644
--- a/src/parse.y
+++ b/src/parse.y
@@ -78,8 +78,12 @@
 #include <assert.h>
 
 #include "input.h"
+#include "BroList.h"
+#include "Desc.h"
 #include "Expr.h"
+#include "Func.h"
 #include "Stmt.h"
+#include "Val.h"
 #include "Var.h"
 /* #include "analyzer/protocol/dns/DNS.h" */
 #include "RE.h"
@@ -87,6 +91,7 @@
 #include "Reporter.h"
 #include "Brofiler.h"
 #include "zeekygen/Manager.h"
+#include "module_util.h"
 
 #include <set>
 #include <string>
diff --git a/src/plugin/ComponentManager.h b/src/plugin/ComponentManager.h
index 88d04bb3f9..8f146c573e 100644
--- a/src/plugin/ComponentManager.h
+++ b/src/plugin/ComponentManager.h
@@ -5,11 +5,11 @@
 #include <string>
 
 #include "Type.h"
-#include "ID.h"
-#include "Var.h"
+#include "Var.h" // for add_type()
 #include "Val.h"
 #include "Reporter.h"
 #include "zeekygen/Manager.h"
+#include "DebugLogger.h"
 
 namespace plugin {
 
diff --git a/src/plugin/Manager.cc b/src/plugin/Manager.cc
index 51b85bdbb5..12c13ac3c3 100644
--- a/src/plugin/Manager.cc
+++ b/src/plugin/Manager.cc
@@ -14,6 +14,7 @@
 #include "../Func.h"
 #include "../Event.h"
 #include "../util.h"
+#include "../input.h"
 
 using namespace plugin;
 
diff --git a/src/plugin/Plugin.cc b/src/plugin/Plugin.cc
index 92bfcae8dc..29f177d329 100644
--- a/src/plugin/Plugin.cc
+++ b/src/plugin/Plugin.cc
@@ -2,15 +2,19 @@
 
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "Plugin.h"
+
 #include <cassert>
 
-#include "Plugin.h"
 #include "Manager.h"
 #include "Component.h"
+#include "Val.h"
 
 #include "../Desc.h"
 #include "../Event.h"
+#include "../Func.h"
 #include "../Conn.h"
+#include "../input.h"
 #include "threading/SerialTypes.h"
 
 using namespace plugin;
diff --git a/src/plugin/Plugin.h b/src/plugin/Plugin.h
index b1fc642667..7e8a35427c 100644
--- a/src/plugin/Plugin.h
+++ b/src/plugin/Plugin.h
@@ -7,9 +7,6 @@
 #include <utility>
 
 #include "zeek-config.h"
-#include "analyzer/Component.h"
-#include "file_analysis/Component.h"
-#include "iosource/Component.h"
 #include "logging/WriterBackend.h"
 
 // Increase this when making incompatible changes to the plugin API. Note
@@ -19,6 +16,7 @@
 #define BRO_PLUGIN_BRO_VERSION BRO_VERSION_FUNCTION
 
 class ODesc;
+class Frame;
 class Func;
 class Event;
 
diff --git a/src/probabilistic/BitVector.cc b/src/probabilistic/BitVector.cc
index abf13302cb..5b3139388a 100644
--- a/src/probabilistic/BitVector.cc
+++ b/src/probabilistic/BitVector.cc
@@ -1,10 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "BitVector.h"
+
+#include <broker/data.hh>
+
 #include <openssl/sha.h>
 #include <cassert>
 #include <limits>
 
-#include "BitVector.h"
 #include "digest.h"
 
 using namespace probabilistic;
diff --git a/src/probabilistic/BitVector.h b/src/probabilistic/BitVector.h
index 8e9333fd6e..cbbcedd80b 100644
--- a/src/probabilistic/BitVector.h
+++ b/src/probabilistic/BitVector.h
@@ -2,11 +2,13 @@
 
 #pragma once
 
+#include <broker/expected.hh>
+
 #include <iterator>
+#include <memory>
 #include <vector>
 
-#include <broker/data.hh>
-#include <broker/expected.hh>
+namespace broker { class data; }
 
 namespace probabilistic {
 
diff --git a/src/probabilistic/BloomFilter.cc b/src/probabilistic/BloomFilter.cc
index e5062f64c9..71996dc6c8 100644
--- a/src/probabilistic/BloomFilter.cc
+++ b/src/probabilistic/BloomFilter.cc
@@ -1,13 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-#include <typeinfo>
+#include "BloomFilter.h"
+
 #include <cmath>
 #include <limits>
 
+#include <broker/data.hh>
 #include <broker/error.hh>
 
-#include "BloomFilter.h"
-
 #include "CounterVector.h"
 
 #include "../util.h"
diff --git a/src/probabilistic/BloomFilter.h b/src/probabilistic/BloomFilter.h
index 950235e5f5..cc3a4a8e72 100644
--- a/src/probabilistic/BloomFilter.h
+++ b/src/probabilistic/BloomFilter.h
@@ -2,15 +2,17 @@
 
 #pragma once
 
+#include <memory>
 #include <vector>
 #include <string>
 
-#include <broker/data.hh>
 #include <broker/expected.hh>
 
 #include "BitVector.h"
 #include "Hasher.h"
 
+namespace broker { class data; }
+
 namespace probabilistic {
 
 class CounterVector;
diff --git a/src/probabilistic/CardinalityCounter.cc b/src/probabilistic/CardinalityCounter.cc
index e5ce31e855..bdc9797125 100644
--- a/src/probabilistic/CardinalityCounter.cc
+++ b/src/probabilistic/CardinalityCounter.cc
@@ -1,10 +1,13 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "CardinalityCounter.h"
+
 #include <math.h>
 #include <stdint.h>
-#include <iostream>
+#include <utility>
+
+#include <broker/data.hh>
 
-#include "CardinalityCounter.h"
 #include "Reporter.h"
 
 using namespace probabilistic;
diff --git a/src/probabilistic/CardinalityCounter.h b/src/probabilistic/CardinalityCounter.h
index ec9397fd84..26f61591b1 100644
--- a/src/probabilistic/CardinalityCounter.h
+++ b/src/probabilistic/CardinalityCounter.h
@@ -2,12 +2,14 @@
 
 #pragma once
 
-#include <stdint.h>
+#include <broker/expected.hh>
+
 #include <memory>
 #include <vector>
 
-#include <broker/data.hh>
-#include <broker/expected.hh>
+#include <stdint.h>
+
+namespace broker { class data; }
 
 namespace probabilistic {
 
diff --git a/src/probabilistic/CounterVector.cc b/src/probabilistic/CounterVector.cc
index 48f71c401b..d4b073bca1 100644
--- a/src/probabilistic/CounterVector.cc
+++ b/src/probabilistic/CounterVector.cc
@@ -4,11 +4,13 @@
 
 #include <cassert>
 #include <limits>
+
+#include <broker/data.hh>
+#include <broker/error.hh>
+
 #include "BitVector.h"
 #include "util.h"
 
-#include <broker/error.hh>
-
 using namespace probabilistic;
 
 CounterVector::CounterVector(size_t arg_width, size_t cells)
diff --git a/src/probabilistic/CounterVector.h b/src/probabilistic/CounterVector.h
index 3476b9f4e6..0cdd05be95 100644
--- a/src/probabilistic/CounterVector.h
+++ b/src/probabilistic/CounterVector.h
@@ -4,10 +4,12 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <memory>
 
-#include <broker/data.hh>
 #include <broker/expected.hh>
 
+namespace broker { class data; }
+
 namespace probabilistic {
 
 class BitVector;
diff --git a/src/probabilistic/Hasher.cc b/src/probabilistic/Hasher.cc
index c01d9efe98..bc46a1ebb6 100644
--- a/src/probabilistic/Hasher.cc
+++ b/src/probabilistic/Hasher.cc
@@ -1,13 +1,17 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "Hasher.h"
+
 #include <typeinfo>
+
 #include <openssl/evp.h>
 
-#include "Hasher.h"
 #include "NetVar.h"
 #include "digest.h"
 #include "siphash24.h"
 
+#include <broker/data.hh>
+
 using namespace probabilistic;
 
 Hasher::seed_t Hasher::MakeSeed(const void* data, size_t size)
diff --git a/src/probabilistic/Hasher.h b/src/probabilistic/Hasher.h
index 6298b881f1..6892b40880 100644
--- a/src/probabilistic/Hasher.h
+++ b/src/probabilistic/Hasher.h
@@ -2,12 +2,13 @@
 
 #pragma once
 
-#include <broker/data.hh>
+#include "Hash.h"
+
 #include <broker/expected.hh>
 
 #include <memory>
 
-#include "Hash.h"
+namespace broker { class data; }
 
 namespace probabilistic {
 
diff --git a/src/probabilistic/Topk.cc b/src/probabilistic/Topk.cc
index 131f490fae..97ef572ddd 100644
--- a/src/probabilistic/Topk.cc
+++ b/src/probabilistic/Topk.cc
@@ -1,10 +1,12 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "probabilistic/Topk.h"
+
 #include <broker/error.hh>
 
 #include "broker/Data.h"
-#include "probabilistic/Topk.h"
 #include "CompHash.h"
+#include "IntrusivePtr.h"
 #include "Reporter.h"
 #include "NetVar.h"
 
diff --git a/src/re-parse.y b/src/re-parse.y
index 164705c040..a7d26420d6 100644
--- a/src/re-parse.y
+++ b/src/re-parse.y
@@ -3,6 +3,7 @@
 %{
 #include <stdlib.h>
 
+#include "RE.h"
 #include "CCL.h"
 #include "NFA.h"
 #include "EquivClass.h"
diff --git a/src/re-scan.l b/src/re-scan.l
index 99dde0ca6c..f7f29027c5 100644
--- a/src/re-scan.l
+++ b/src/re-scan.l
@@ -5,6 +5,7 @@
  */
 
 %{
+#include "RE.h"
 #include "CCL.h"
 #include "NFA.h"
 #include "util.h"
diff --git a/src/rule-parse.y b/src/rule-parse.y
index df12bd1d9b..cd44e4d205 100644
--- a/src/rule-parse.y
+++ b/src/rule-parse.y
@@ -3,6 +3,8 @@
 #include <netinet/in.h>
 #include <vector>
 #include "zeek-config.h"
+#include "RuleAction.h"
+#include "RuleCondition.h"
 #include "RuleMatcher.h"
 #include "Reporter.h"
 #include "IPAddr.h"
diff --git a/src/rule-scan.l b/src/rule-scan.l
index e9d2b4fece..f34935d361 100644
--- a/src/rule-scan.l
+++ b/src/rule-scan.l
@@ -6,6 +6,7 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include "RuleMatcher.h"
+#include "RuleCondition.h"
 #include "IPAddr.h"
 #include "util.h"
 #include "rule-parse.h"
diff --git a/src/scan.l b/src/scan.l
index 9e0a95f56d..5e32a41ab9 100644
--- a/src/scan.l
+++ b/src/scan.l
@@ -15,10 +15,12 @@
 #include "input.h"
 #include "util.h"
 #include "Scope.h"
+#include "BroString.h"
 #include "DNS_Mgr.h"
 #include "Expr.h"
 #include "Func.h"
 #include "Stmt.h"
+#include "Val.h"
 #include "Var.h"
 #include "Debug.h"
 #include "PolicyFile.h"
@@ -27,6 +29,7 @@
 #include "RE.h"
 #include "Net.h"
 #include "Traverse.h"
+#include "module_util.h"
 
 #include "analyzer/Analyzer.h"
 #include "zeekygen/Manager.h"
diff --git a/src/supervisor/Supervisor.cc b/src/supervisor/Supervisor.cc
index 124c9b7771..fea5e2a3ee 100644
--- a/src/supervisor/Supervisor.cc
+++ b/src/supervisor/Supervisor.cc
@@ -1,5 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
+#include "Supervisor.h"
+
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
@@ -11,14 +13,15 @@
 #include <sstream>
 
 #include "iosource/Manager.h"
-#include "Supervisor.h"
 #include "Reporter.h"
 #include "DebugLogger.h"
+#include "ID.h"
 #include "Val.h"
 #include "Net.h"
 #include "NetVar.h"
 #include "zeek-config.h"
 #include "util.h"
+#include "input.h"
 #include "zeek-affinity.h"
 
 #define RAPIDJSON_HAS_STDSTRING 1
diff --git a/src/threading/BasicThread.h b/src/threading/BasicThread.h
index d9c1b809b9..fba5acaeeb 100644
--- a/src/threading/BasicThread.h
+++ b/src/threading/BasicThread.h
@@ -1,9 +1,10 @@
 
 #pragma once
 
+#include <iosfwd>
 #include <thread>
 
-#include "util.h"
+#include <stdint.h>
 
 using namespace std;
 
diff --git a/src/threading/Formatter.cc b/src/threading/Formatter.cc
index 5fa8ab6fa9..462067303a 100644
--- a/src/threading/Formatter.cc
+++ b/src/threading/Formatter.cc
@@ -1,11 +1,11 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "Formatter.h"
 
-#include <sstream>
 #include <errno.h>
 
-#include "Formatter.h"
+#include "MsgThread.h"
 #include "bro_inet_ntop.h"
 
 using namespace threading;
diff --git a/src/threading/Formatter.h b/src/threading/Formatter.h
index a3823d3a57..64a8502bc5 100644
--- a/src/threading/Formatter.h
+++ b/src/threading/Formatter.h
@@ -2,10 +2,18 @@
 
 #pragma once
 
-#include "../Desc.h"
-#include "MsgThread.h"
+#include "Type.h"
+#include "SerialTypes.h"
 
-namespace threading { namespace formatter {
+#include <string>
+
+using std::string;
+
+namespace threading {
+
+class MsgThread;
+
+namespace formatter {
 
 /**
   * A thread-safe class for converting values into some textual format. This
diff --git a/src/threading/Manager.cc b/src/threading/Manager.cc
index a8d721b76c..d10e38c89b 100644
--- a/src/threading/Manager.cc
+++ b/src/threading/Manager.cc
@@ -1,7 +1,8 @@
+#include "Manager.h"
+
 #include <sys/socket.h>
 #include <unistd.h>
 
-#include "Manager.h"
 #include "NetVar.h"
 #include "iosource/Manager.h"
 
diff --git a/src/threading/Manager.h b/src/threading/Manager.h
index 132d2238c4..c9acbbef8a 100644
--- a/src/threading/Manager.h
+++ b/src/threading/Manager.h
@@ -1,12 +1,12 @@
 
 #pragma once
 
-#include <list>
-
-#include "BasicThread.h"
 #include "MsgThread.h"
 #include "Timer.h"
 
+#include <list>
+#include <utility>
+
 namespace threading {
 
 class HeartbeatTimer : public Timer {
diff --git a/src/threading/formatters/Ascii.cc b/src/threading/formatters/Ascii.cc
index b828616972..a8dd8efa69 100644
--- a/src/threading/formatters/Ascii.cc
+++ b/src/threading/formatters/Ascii.cc
@@ -2,11 +2,13 @@
 
 #include "zeek-config.h"
 
+#include "Ascii.h"
+#include "Desc.h"
+#include "threading/MsgThread.h"
+
 #include <sstream>
 #include <errno.h>
 
-#include "./Ascii.h"
-
 using namespace threading::formatter;
 
 // If the value we'd write out would match exactly the a reserved string, we
diff --git a/src/threading/formatters/JSON.cc b/src/threading/formatters/JSON.cc
index 065de3f086..ad03aaf8a0 100644
--- a/src/threading/formatters/JSON.cc
+++ b/src/threading/formatters/JSON.cc
@@ -2,6 +2,11 @@
 
 #include "zeek-config.h"
 
+#include "JSON.h"
+#include "3rdparty/rapidjson/include/rapidjson/internal/ieee754.h"
+#include "Desc.h"
+#include "threading/MsgThread.h"
+
 #ifndef __STDC_LIMIT_MACROS
 #define __STDC_LIMIT_MACROS
 #endif
@@ -11,9 +16,6 @@
 #include <math.h>
 #include <stdint.h>
 
-#include "JSON.h"
-#include "3rdparty/rapidjson/include/rapidjson/internal/ieee754.h"
-
 using namespace threading::formatter;
 
 bool JSON::NullDoubleWriter::Double(double d)
diff --git a/src/util.cc b/src/util.cc
index de3bacbe9d..1a9b01d5bb 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -1,6 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "zeek-config.h"
+#include "util.h"
 #include "util-config.h"
 
 #ifdef TIME_WITH_SYS_TIME
@@ -42,9 +43,9 @@
 # include <malloc.h>
 #endif
 
+#include "Desc.h"
 #include "digest.h"
 #include "input.h"
-#include "util.h"
 #include "Obj.h"
 #include "Val.h"
 #include "NetVar.h"
diff --git a/src/zeek.bif b/src/zeek.bif
index 7129add1c6..91055a1257 100644
--- a/src/zeek.bif
+++ b/src/zeek.bif
@@ -26,6 +26,7 @@
 #include "iosource/PktSrc.h"
 #include "iosource/PktDumper.h"
 #include "IntrusivePtr.h"
+#include "input.h"
 
 using namespace std;
 
diff --git a/src/zeekygen/Configuration.cc b/src/zeekygen/Configuration.cc
index dbbbebf578..3e7708dd6a 100644
--- a/src/zeekygen/Configuration.cc
+++ b/src/zeekygen/Configuration.cc
@@ -3,7 +3,6 @@
 #include "Configuration.h"
 #include "utils.h"
 
-#include "util.h"
 #include "Reporter.h"
 
 #include <fstream>
diff --git a/src/zeekygen/Configuration.h b/src/zeekygen/Configuration.h
index 8829e5046d..669d341e6d 100644
--- a/src/zeekygen/Configuration.h
+++ b/src/zeekygen/Configuration.h
@@ -2,14 +2,17 @@
 
 #pragma once
 
-#include "Info.h"
 #include "Target.h"
 
 #include <string>
 #include <vector>
 
+#include <time.h> // for time_t
+
 namespace zeekygen {
 
+class Info;
+
 /**
  * Manages the generation of reStructuredText documents corresponding to
  * particular targets that are specified in a config file.  The config file
diff --git a/src/zeekygen/IdentifierInfo.cc b/src/zeekygen/IdentifierInfo.cc
index 5db21ed956..5ff5b5dfa3 100644
--- a/src/zeekygen/IdentifierInfo.cc
+++ b/src/zeekygen/IdentifierInfo.cc
@@ -1,6 +1,7 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "IdentifierInfo.h"
+#include "ScriptInfo.h"
 #include "utils.h"
 
 #include "Desc.h"
@@ -179,3 +180,8 @@ IdentifierInfo::Redefinition::~Redefinition()
 	{
 	Unref(init_expr);
 	}
+
+IdentifierInfo::RecordField::~RecordField()
+	{
+	delete field;
+	}
diff --git a/src/zeekygen/IdentifierInfo.h b/src/zeekygen/IdentifierInfo.h
index 1860c0f25a..56ae00f0b8 100644
--- a/src/zeekygen/IdentifierInfo.h
+++ b/src/zeekygen/IdentifierInfo.h
@@ -3,16 +3,17 @@
 #pragma once
 
 #include "Info.h"
-#include "ScriptInfo.h"
-
 #include "ID.h"
-#include "Type.h"
 
 #include <string>
 #include <vector>
 #include <list>
 #include <map>
 
+#include <time.h> // for time_t
+
+class TypeDecl;
+
 namespace zeekygen {
 
 class ScriptInfo;
@@ -165,8 +166,7 @@ private:
 	std::string DoReStructuredText(bool roles_only) const override;
 
 	struct RecordField {
-		~RecordField()
-			{ delete field; }
+		~RecordField();
 
 		TypeDecl* field;
 		std::string from_script;
diff --git a/src/zeekygen/Manager.cc b/src/zeekygen/Manager.cc
index 57cc19d531..555f178133 100644
--- a/src/zeekygen/Manager.cc
+++ b/src/zeekygen/Manager.cc
@@ -3,6 +3,10 @@
 #include "Manager.h"
 #include "plugin/Manager.h"
 #include "util.h"
+#include "Info.h"
+#include "PackageInfo.h"
+#include "ScriptInfo.h"
+#include "IdentifierInfo.h"
 
 #include <utility>
 #include <cstdlib>
diff --git a/src/zeekygen/Manager.h b/src/zeekygen/Manager.h
index 1f988c880b..988d641370 100644
--- a/src/zeekygen/Manager.h
+++ b/src/zeekygen/Manager.h
@@ -3,15 +3,9 @@
 #pragma once
 
 #include "Configuration.h"
-#include "Info.h"
-#include "PackageInfo.h"
-#include "ScriptInfo.h"
-#include "IdentifierInfo.h"
 
 #include "Reporter.h"
 #include "ID.h"
-#include "Type.h"
-#include "Val.h"
 
 #include <string>
 #include <vector>
@@ -20,8 +14,13 @@
 #include <sys/stat.h>
 #include <errno.h>
 
+class TypeDecl;
+
 namespace zeekygen {
 
+class PackageInfo;
+class ScriptInfo;
+
 /**
  * Map of info objects.  Just a wrapper around std::map to improve code
  * readability (less typedefs for specific map types and not having to use
diff --git a/src/zeekygen/PackageInfo.h b/src/zeekygen/PackageInfo.h
index 00be437bac..b9d2591a2e 100644
--- a/src/zeekygen/PackageInfo.h
+++ b/src/zeekygen/PackageInfo.h
@@ -7,6 +7,8 @@
 #include <string>
 #include <vector>
 
+#include <time.h> // for time_t
+
 namespace zeekygen {
 
 /**
diff --git a/src/zeekygen/ScriptInfo.cc b/src/zeekygen/ScriptInfo.cc
index d55b42b7bc..6e8afda0ef 100644
--- a/src/zeekygen/ScriptInfo.cc
+++ b/src/zeekygen/ScriptInfo.cc
@@ -5,6 +5,8 @@
 #include "ReStructuredTextTable.h"
 #include "utils.h"
 #include "Manager.h"
+#include "Scope.h"
+#include "DebugLogger.h"
 
 #include "Reporter.h"
 #include "Desc.h"
diff --git a/src/zeekygen/ScriptInfo.h b/src/zeekygen/ScriptInfo.h
index 153fb0e54c..2ebd9b3968 100644
--- a/src/zeekygen/ScriptInfo.h
+++ b/src/zeekygen/ScriptInfo.h
@@ -3,7 +3,6 @@
 #pragma once
 
 #include "Info.h"
-#include "IdentifierInfo.h"
 
 #include <set>
 #include <list>
@@ -11,6 +10,8 @@
 #include <vector>
 #include <map>
 
+#include <time.h> // for time_t
+
 namespace zeekygen {
 
 class IdentifierInfo;
diff --git a/src/zeekygen/Target.cc b/src/zeekygen/Target.cc
index afb96cbd8b..85071b31e7 100644
--- a/src/zeekygen/Target.cc
+++ b/src/zeekygen/Target.cc
@@ -2,6 +2,9 @@
 
 #include "Target.h"
 #include "Manager.h"
+#include "IdentifierInfo.h"
+#include "PackageInfo.h"
+#include "ScriptInfo.h"
 
 #include "util.h"
 #include "Reporter.h"
diff --git a/src/zeekygen/Target.h b/src/zeekygen/Target.h
index 9d18f6e4c5..9aa95e58cf 100644
--- a/src/zeekygen/Target.h
+++ b/src/zeekygen/Target.h
@@ -2,11 +2,6 @@
 
 #pragma once
 
-#include "Info.h"
-#include "PackageInfo.h"
-#include "ScriptInfo.h"
-#include "IdentifierInfo.h"
-
 #include <map>
 #include <string>
 #include <vector>
@@ -14,6 +9,11 @@
 
 namespace zeekygen {
 
+class Info;
+class PackageInfo;
+class ScriptInfo;
+class IdentifierInfo;
+
 /**
  * Helper class to create files in arbitrary file paths and automatically
  * close it on destruction.
diff --git a/src/zeekygen/utils.cc b/src/zeekygen/utils.cc
index b04790ee92..c661b84539 100644
--- a/src/zeekygen/utils.cc
+++ b/src/zeekygen/utils.cc
@@ -1,6 +1,8 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
 #include "utils.h"
+#include "ID.h"
+#include "Scope.h"
 
 #include "Reporter.h"
 
diff --git a/src/zeekygen/utils.h b/src/zeekygen/utils.h
index 27975207a3..e5ddcc49a4 100644
--- a/src/zeekygen/utils.h
+++ b/src/zeekygen/utils.h
@@ -2,10 +2,12 @@
 
 #pragma once
 
-#include "ID.h"
-
 #include <string>
 
+#include <time.h> // for time_t
+
+class ID;
+
 namespace zeekygen {
 
 /**
diff --git a/src/zeekygen/zeekygen.bif b/src/zeekygen/zeekygen.bif
index d97cd782bd..289054f076 100644
--- a/src/zeekygen/zeekygen.bif
+++ b/src/zeekygen/zeekygen.bif
@@ -4,6 +4,9 @@
 
 %%{
 #include "zeekygen/Manager.h"
+#include "zeekygen/IdentifierInfo.h"
+#include "zeekygen/PackageInfo.h"
+#include "zeekygen/ScriptInfo.h"
 #include "util.h"
 
 static StringVal* comments_to_val(const vector<string>& comments)
diff --git a/testing/btest/plugins/file-plugin/src/Foo.cc b/testing/btest/plugins/file-plugin/src/Foo.cc
index 5dde4634ab..3c4fb403ab 100644
--- a/testing/btest/plugins/file-plugin/src/Foo.cc
+++ b/testing/btest/plugins/file-plugin/src/Foo.cc
@@ -1,5 +1,7 @@
 
 #include "Foo.h"
+#include "file_analysis/File.h"
+
 #include <events.bif.h>
 #include <file_analysis/Manager.h>
 
diff --git a/testing/btest/plugins/file-plugin/src/Plugin.cc b/testing/btest/plugins/file-plugin/src/Plugin.cc
index 5c61d28e28..ea38628aaa 100644
--- a/testing/btest/plugins/file-plugin/src/Plugin.cc
+++ b/testing/btest/plugins/file-plugin/src/Plugin.cc
@@ -1,7 +1,8 @@
 
-#include "Plugin.h"
-
 #include "Foo.h"
+#include "Plugin.h"
+#include "file_analysis/Component.h"
+#include "file_analysis/File.h"
 
 namespace plugin { namespace Demo_Foo { Plugin plugin; } }
 
diff --git a/testing/btest/plugins/hooks-plugin/src/Plugin.cc b/testing/btest/plugins/hooks-plugin/src/Plugin.cc
index 52aea76bda..473de5f5c0 100644
--- a/testing/btest/plugins/hooks-plugin/src/Plugin.cc
+++ b/testing/btest/plugins/hooks-plugin/src/Plugin.cc
@@ -4,6 +4,7 @@
 #include <Func.h>
 #include <Event.h>
 #include <Conn.h>
+#include <Desc.h>
 #include <threading/Formatter.h>
 
 namespace plugin { namespace Demo_Hooks { Plugin plugin; } }
diff --git a/testing/btest/plugins/logging-hooks-plugin/src/Plugin.cc b/testing/btest/plugins/logging-hooks-plugin/src/Plugin.cc
index eb06d5a27d..95a669aa22 100644
--- a/testing/btest/plugins/logging-hooks-plugin/src/Plugin.cc
+++ b/testing/btest/plugins/logging-hooks-plugin/src/Plugin.cc
@@ -4,6 +4,7 @@
 #include <Func.h>
 #include <Event.h>
 #include <Conn.h>
+#include <Desc.h>
 #include <threading/Formatter.h>
 
 namespace plugin { namespace Log_Hooks { Plugin plugin; } }
diff --git a/testing/btest/plugins/pktdumper-plugin/src/Foo.cc b/testing/btest/plugins/pktdumper-plugin/src/Foo.cc
index c68eec809a..99a269c02e 100644
--- a/testing/btest/plugins/pktdumper-plugin/src/Foo.cc
+++ b/testing/btest/plugins/pktdumper-plugin/src/Foo.cc
@@ -1,9 +1,10 @@
 
+#include "Foo.h"
+#include "iosource/Packet.h"
+
 #include <fcntl.h>
 #include <stdio.h>
 
-#include "Foo.h"
-
 using namespace plugin::Demo_Foo;
 
 Foo::Foo(const std::string& path, bool is_live)
diff --git a/testing/btest/plugins/pktdumper-plugin/src/Plugin.cc b/testing/btest/plugins/pktdumper-plugin/src/Plugin.cc
index f4417ff6a2..1836ad7b4a 100644
--- a/testing/btest/plugins/pktdumper-plugin/src/Plugin.cc
+++ b/testing/btest/plugins/pktdumper-plugin/src/Plugin.cc
@@ -2,6 +2,8 @@
 #include "Plugin.h"
 
 #include "Foo.h"
+#include "iosource/Component.h"
+
 
 namespace plugin { namespace Demo_Foo { Plugin plugin; } }
 
diff --git a/testing/btest/plugins/pktsrc-plugin/src/Foo.cc b/testing/btest/plugins/pktsrc-plugin/src/Foo.cc
index b2b768b4ba..012b1f226a 100644
--- a/testing/btest/plugins/pktsrc-plugin/src/Foo.cc
+++ b/testing/btest/plugins/pktsrc-plugin/src/Foo.cc
@@ -1,9 +1,13 @@
 
+#include "Foo.h"
+
+extern "C" {
+#include <pcap.h>
+}
+
 #include <fcntl.h>
 #include <stdio.h>
 
-#include "Foo.h"
-
 using namespace plugin::Demo_Foo;
 
 Foo::Foo(const std::string& path, bool is_live)
diff --git a/testing/btest/plugins/pktsrc-plugin/src/Plugin.cc b/testing/btest/plugins/pktsrc-plugin/src/Plugin.cc
index 088a4dd36d..6723651cce 100644
--- a/testing/btest/plugins/pktsrc-plugin/src/Plugin.cc
+++ b/testing/btest/plugins/pktsrc-plugin/src/Plugin.cc
@@ -2,6 +2,7 @@
 #include "Plugin.h"
 
 #include "Foo.h"
+#include "iosource/Component.h"
 
 namespace plugin { namespace Demo_Foo { Plugin plugin; } }
 
diff --git a/testing/btest/plugins/protocol-plugin/src/Plugin.cc b/testing/btest/plugins/protocol-plugin/src/Plugin.cc
index bd2662d67c..5a7bfb63b2 100644
--- a/testing/btest/plugins/protocol-plugin/src/Plugin.cc
+++ b/testing/btest/plugins/protocol-plugin/src/Plugin.cc
@@ -1,5 +1,6 @@
 
 #include "Plugin.h"
+#include "analyzer/Component.h"
 
 #include "Foo.h"
 
diff --git a/testing/btest/plugins/reporter-hook-plugin/src/Plugin.cc b/testing/btest/plugins/reporter-hook-plugin/src/Plugin.cc
index d9c856966a..375d9951aa 100644
--- a/testing/btest/plugins/reporter-hook-plugin/src/Plugin.cc
+++ b/testing/btest/plugins/reporter-hook-plugin/src/Plugin.cc
@@ -4,6 +4,7 @@
 #include <Func.h>
 #include <Event.h>
 #include <Conn.h>
+#include <Desc.h>
 #include <threading/Formatter.h>
 
 namespace plugin { namespace Reporter_Hook { Plugin plugin; } }
diff --git a/testing/btest/plugins/writer-plugin/src/Foo.h b/testing/btest/plugins/writer-plugin/src/Foo.h
index 64ca166b63..5a3e336fbf 100644
--- a/testing/btest/plugins/writer-plugin/src/Foo.h
+++ b/testing/btest/plugins/writer-plugin/src/Foo.h
@@ -3,6 +3,7 @@
 
 #include "logging/WriterBackend.h"
 #include "threading/formatters/Ascii.h"
+#include "Desc.h"
 
 namespace logging { namespace writer {