diff --git a/src/Anon.h b/src/Anon.h
index ce234f4680..4270b88d45 100644
--- a/src/Anon.h
+++ b/src/Anon.h
@@ -66,7 +66,7 @@ protected:
 class AnonymizeIPAddr_Seq : public AnonymizeIPAddr {
 public:
 	AnonymizeIPAddr_Seq()	{ seq = 1; }
-	ipaddr32_t anonymize(ipaddr32_t addr);
+	ipaddr32_t anonymize(ipaddr32_t addr) override;
 
 protected:
 	ipaddr32_t seq;
@@ -74,12 +74,12 @@ protected:
 
 class AnonymizeIPAddr_RandomMD5 : public AnonymizeIPAddr {
 public:
-	ipaddr32_t anonymize(ipaddr32_t addr);
+	ipaddr32_t anonymize(ipaddr32_t addr) override;
 };
 
 class AnonymizeIPAddr_PrefixMD5 : public AnonymizeIPAddr {
 public:
-	ipaddr32_t anonymize(ipaddr32_t addr);
+	ipaddr32_t anonymize(ipaddr32_t addr) override;
 
 protected:
 	struct anon_prefix {
@@ -91,10 +91,10 @@ protected:
 class AnonymizeIPAddr_A50 : public AnonymizeIPAddr {
 public:
 	AnonymizeIPAddr_A50()	{ init(); }
-	~AnonymizeIPAddr_A50();
+	~AnonymizeIPAddr_A50() override;
 
-	ipaddr32_t anonymize(ipaddr32_t addr);
-	int PreservePrefix(ipaddr32_t input, int num_bits);
+	ipaddr32_t anonymize(ipaddr32_t addr) override;
+	int PreservePrefix(ipaddr32_t input, int num_bits) override;
 
 protected:
 	struct Node {
diff --git a/src/Attr.h b/src/Attr.h
index 0960a9d5f9..bfb7c4803c 100644
--- a/src/Attr.h
+++ b/src/Attr.h
@@ -40,8 +40,8 @@ typedef enum {
 
 class Attr : public BroObj {
 public:
-	Attr(attr_tag t, Expr* e = 0);
-	~Attr();
+	explicit Attr(attr_tag t, Expr* e = 0);
+	~Attr() override;
 
 	attr_tag Tag() const	{ return tag; }
 	Expr* AttrExpr() const	{ return expr; }
@@ -56,7 +56,7 @@ public:
 	int RedundantAttrOkay() const
 		{ return tag == ATTR_REDEF || tag == ATTR_OPTIONAL; }
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 	void DescribeReST(ODesc* d) const;
 
 	bool operator==(const Attr& other) const
@@ -84,7 +84,7 @@ protected:
 class Attributes : public BroObj {
 public:
 	Attributes(attr_list* a, BroType* t, bool in_record);
-	~Attributes();
+	~Attributes() override;
 
 	void AddAttr(Attr* a);
 	void AddAttrs(Attributes* a);	// Unref's 'a' when done
diff --git a/src/Base64.h b/src/Base64.h
index fb030915ef..b1f5200cd6 100644
--- a/src/Base64.h
+++ b/src/Base64.h
@@ -18,7 +18,7 @@ public:
 	// encode_base64()), encoding-errors will go to Reporter instead of
 	// Weird. Usage errors go to Reporter in any case. Empty alphabet
 	// indicates the default base64 alphabet.
-	Base64Converter(Connection* conn, const string& alphabet = "");
+	explicit Base64Converter(Connection* conn, const string& alphabet = "");
 	~Base64Converter();
 
 	// A note on Decode():
diff --git a/src/BroString.h b/src/BroString.h
index 9afd40e5d7..cad03e83d8 100644
--- a/src/BroString.h
+++ b/src/BroString.h
@@ -36,8 +36,8 @@ public:
 
 	// Constructors creating internal copies of the data passed in.
 	BroString(const u_char* str, int arg_n, int add_NUL);
-	BroString(const char* str);
-	BroString(const string& str);
+	explicit BroString(const char* str);
+	explicit BroString(const string& str);
 	BroString(const BroString& bs);
 
 	// Constructor that takes owernship of the vector passed in.
@@ -158,7 +158,7 @@ protected:
 //
 class BroStringLenCmp {
 public:
-	BroStringLenCmp(bool increasing = true) { _increasing = increasing; }
+	explicit BroStringLenCmp(bool increasing = true) { _increasing = increasing; }
 	bool operator()(BroString*const& bst1, BroString*const& bst2);
 
  private:
diff --git a/src/ChunkedIO.h b/src/ChunkedIO.h
index de3e143b66..e9b41476df 100644
--- a/src/ChunkedIO.h
+++ b/src/ChunkedIO.h
@@ -167,21 +167,21 @@ public:
 	// messages, and pid gives a pid to monitor (if the process dies, we
 	// return EOF).
 	ChunkedIOFd(int fd, const char* tag, pid_t pid = 0);
-	virtual ~ChunkedIOFd();
+	~ChunkedIOFd() override;
 
-	virtual bool Read(Chunk** chunk, bool may_block = false);
-	virtual bool Write(Chunk* chunk);
-	virtual bool Flush();
-	virtual const char* Error();
-	virtual bool CanRead();
-	virtual bool CanWrite();
-	virtual bool IsIdle();
-	virtual bool IsFillingUp();
-	virtual void Clear();
-	virtual bool Eof()	{ return eof; }
-	virtual int Fd()	{ return fd; }
-	virtual iosource::FD_Set ExtraReadFDs() const;
-	virtual void Stats(char* buffer, int length);
+	bool Read(Chunk** chunk, bool may_block = false) override;
+	bool Write(Chunk* chunk) override;
+	bool Flush() override;
+	const char* Error() override;
+	bool CanRead() override;
+	bool CanWrite() override;
+	bool IsIdle() override;
+	bool IsFillingUp() override;
+	void Clear() override;
+	bool Eof() override { return eof; }
+	int Fd() override { return fd; }
+	iosource::FD_Set ExtraReadFDs() const override;
+	void Stats(char* buffer, int length) override;
 
 private:
 
@@ -252,22 +252,22 @@ public:
 	// Argument is an open socket and a flag indicating whether we are the
 	// server side of the connection.
 	ChunkedIOSSL(int socket, bool server);
-	virtual ~ChunkedIOSSL();
+	~ChunkedIOSSL() override;
 
-	virtual bool Init();
-	virtual bool Read(Chunk** chunk, bool mayblock = false);
-	virtual bool Write(Chunk* chunk);
-	virtual bool Flush();
-	virtual const char* Error();
-	virtual bool CanRead();
-	virtual bool CanWrite();
-	virtual bool IsIdle();
-	virtual bool IsFillingUp();
-	virtual void Clear();
-	virtual bool Eof()	{ return eof; }
-	virtual int Fd()	{ return socket; }
-	virtual iosource::FD_Set ExtraReadFDs() const;
-	virtual void Stats(char* buffer, int length);
+	bool Init() override;
+	bool Read(Chunk** chunk, bool mayblock = false) override;
+	bool Write(Chunk* chunk) override;
+	bool Flush() override;
+	const char* Error() override;
+	bool CanRead() override;
+	bool CanWrite() override;
+	bool IsIdle() override;
+	bool IsFillingUp() override;
+	void Clear() override;
+	bool Eof() override { return eof; }
+	int Fd() override { return socket; }
+	iosource::FD_Set ExtraReadFDs() const override;
+	void Stats(char* buffer, int length) override;
 
 private:
 
@@ -315,27 +315,27 @@ private:
 // Wrapper class around a another ChunkedIO which the (un-)compresses data.
 class CompressedChunkedIO : public ChunkedIO {
 public:
-	CompressedChunkedIO(ChunkedIO* arg_io) // takes ownership
+	explicit CompressedChunkedIO(ChunkedIO* arg_io) // takes ownership
 	    : io(arg_io), zin(), zout(), error(), compress(), uncompress(),
 	      uncompressed_bytes_read(), uncompressed_bytes_written() {}
-	virtual ~CompressedChunkedIO()	{ delete io; }
+	~CompressedChunkedIO() override { delete io; }
 
-	virtual bool Init(); // does *not* call arg_io->Init()
-	virtual bool Read(Chunk** chunk, bool may_block = false);
-	virtual bool Write(Chunk* chunk);
-	virtual bool Flush()	{ return io->Flush(); }
-	virtual const char* Error()	{ return error ? error : io->Error(); }
-	virtual bool CanRead()	{ return io->CanRead(); }
-	virtual bool CanWrite()	{ return io->CanWrite(); }
-	virtual bool IsIdle()	{ return io->IsIdle(); }
-	virtual bool IsFillingUp()	{ return io->IsFillingUp(); }
-	virtual void Clear()	{ return io->Clear(); }
+	bool Init() override; // does *not* call arg_io->Init()
+	bool Read(Chunk** chunk, bool may_block = false) override;
+	bool Write(Chunk* chunk) override;
+	bool Flush() override { return io->Flush(); }
+	const char* Error() override { return error ? error : io->Error(); }
+	bool CanRead() override { return io->CanRead(); }
+	bool CanWrite() override { return io->CanWrite(); }
+	bool IsIdle() override { return io->IsIdle(); }
+	bool IsFillingUp() override { return io->IsFillingUp(); }
+	void Clear() override { return io->Clear(); }
+	bool Eof() override { return io->Eof(); }
 
-	virtual bool Eof()	{ return io->Eof(); }
-	virtual int Fd()	{ return io->Fd(); }
-	virtual iosource::FD_Set ExtraReadFDs() const
+	int Fd() override { return io->Fd(); }
+	iosource::FD_Set ExtraReadFDs() const override
 		{ return io->ExtraReadFDs(); }
-	virtual void Stats(char* buffer, int length);
+	void Stats(char* buffer, int length) override;
 
 	void EnableCompression(int level)
 		{ deflateInit(&zout, level); compress = true; }
diff --git a/src/CompHash.h b/src/CompHash.h
index 1a02114358..532b2781ae 100644
--- a/src/CompHash.h
+++ b/src/CompHash.h
@@ -10,7 +10,7 @@ class ListVal;
 
 class CompositeHash {
 public:
-	CompositeHash(TypeList* composite_type);
+	explicit CompositeHash(TypeList* composite_type);
 	~CompositeHash();
 
 	// Compute the hash corresponding to the given index val,
diff --git a/src/Conn.h b/src/Conn.h
index b58ed0c2b8..db0cb2fe55 100644
--- a/src/Conn.h
+++ b/src/Conn.h
@@ -57,7 +57,7 @@ class Connection : public BroObj {
 public:
 	Connection(NetSessions* s, HashKey* k, double t, const ConnID* id,
 	           uint32 flow, const Packet* pkt, const EncapsulationStack* arg_encap);
-	virtual ~Connection();
+	~Connection() override;
 
 	// Invoked when an encapsulation is discovered. It records the
 	// encapsulation with the connection and raises a "tunnel_changed"
@@ -252,7 +252,7 @@ public:
 	// Sets the transport protocol in use.
 	void SetTransport(TransportProto arg_proto)	{ proto = arg_proto; }
 
-	void SetUID(Bro::UID arg_uid)	 { uid = arg_uid; }
+	void SetUID(const Bro::UID &arg_uid)	 { uid = arg_uid; }
 
 	Bro::UID GetUID() const { return uid; }
 
@@ -336,7 +336,7 @@ public:
 			double arg_t, int arg_do_expire, TimerType arg_type)
 		: Timer(arg_t, arg_type)
 		{ Init(arg_conn, arg_timer, arg_do_expire); }
-	virtual ~ConnectionTimer();
+	~ConnectionTimer() override;
 
 	void Dispatch(double t, int is_expire) override;
 
diff --git a/src/DFA.h b/src/DFA.h
index 8af4907da1..2f06f4e98f 100644
--- a/src/DFA.h
+++ b/src/DFA.h
@@ -23,7 +23,7 @@ class DFA_State : public BroObj {
 public:
 	DFA_State(int state_num, const EquivClass* ec,
 			NFA_state_list* nfa_states, AcceptingSet* accept);
-	~DFA_State();
+	~DFA_State() override;
 
 	int StateNum() const		{ return state_num; }
 	int NFAStateNum() const		{ return nfa_states->length(); }
@@ -44,7 +44,7 @@ public:
 	// Returns the equivalence classes of ec's corresponding to this state.
 	const EquivClass* MetaECs() const	{ return meta_ec; }
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 	void Dump(FILE* f, DFA_Machine* m);
 	void Stats(unsigned int* computed, unsigned int* uncomputed);
 	unsigned int Size();
@@ -117,7 +117,7 @@ typedef PList(DFA_State) DFA_state_list;
 class DFA_Machine : public BroObj {
 public:
 	DFA_Machine(NFA_Machine* n, EquivClass* ec);
-	~DFA_Machine();
+	~DFA_Machine() override;
 
 	DFA_State* StartState() const	{ return start_state; }
 
@@ -127,7 +127,7 @@ public:
 
 	int Rep(int sym);
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 	void Dump(FILE* f);
 
 	unsigned int MemoryAllocation() const;
diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc
index 7040b9a882..7f651b5fdd 100644
--- a/src/DNS_Mgr.cc
+++ b/src/DNS_Mgr.cc
@@ -112,7 +112,7 @@ public:
 	IPAddr ReqAddr() const		{ return req_addr; }
 	string ReqStr() const
 		{
-		return req_host ? req_host : req_addr;
+		return req_host ? req_host : req_addr.AsString();
 		}
 
 	ListVal* Addrs();
diff --git a/src/DNS_Mgr.h b/src/DNS_Mgr.h
index d8f420e6cc..0358ceba18 100644
--- a/src/DNS_Mgr.h
+++ b/src/DNS_Mgr.h
@@ -42,8 +42,8 @@ enum DNS_MgrMode {
 
 class DNS_Mgr : public iosource::IOSource {
 public:
-	DNS_Mgr(DNS_MgrMode mode);
-	virtual ~DNS_Mgr();
+	explicit DNS_Mgr(DNS_MgrMode mode);
+	~DNS_Mgr() override;
 
 	void InitPostScript();
 	void Flush();
@@ -132,11 +132,11 @@ protected:
 	void DoProcess(bool flush);
 
 	// IOSource interface.
-	virtual void GetFds(iosource::FD_Set* read, iosource::FD_Set* write,
-	                    iosource::FD_Set* except);
-	virtual double NextTimestamp(double* network_time);
-	virtual void Process();
-	virtual const char* Tag()	{ return "DNS_Mgr"; }
+	void GetFds(iosource::FD_Set* read, iosource::FD_Set* write,
+	                    iosource::FD_Set* except) override;
+	double NextTimestamp(double* network_time) override;
+	void Process() override;
+	const char* Tag() override { return "DNS_Mgr"; }
 
 	DNS_MgrMode mode;
 
diff --git a/src/DbgWatch.h b/src/DbgWatch.h
index e3359f53ad..3722d10e69 100644
--- a/src/DbgWatch.h
+++ b/src/DbgWatch.h
@@ -7,8 +7,8 @@
 
 class DbgWatch {
 public:
-	DbgWatch(BroObj* var_to_watch);
-	DbgWatch(Expr* expr_to_watch);
+	explicit DbgWatch(BroObj* var_to_watch);
+	explicit DbgWatch(Expr* expr_to_watch);
 	~DbgWatch();
 
 protected:
diff --git a/src/Desc.h b/src/Desc.h
index fb56aad9ea..8f7ae53ac4 100644
--- a/src/Desc.h
+++ b/src/Desc.h
@@ -27,7 +27,7 @@ class BroType;
 
 class ODesc {
 public:
-	ODesc(desc_type t=DESC_READABLE, BroFile* f=0);
+	explicit ODesc(desc_type t=DESC_READABLE, BroFile* f=0);
 
 	~ODesc();
 
diff --git a/src/Dict.h b/src/Dict.h
index 8a0b6b4f3d..a929319450 100644
--- a/src/Dict.h
+++ b/src/Dict.h
@@ -29,7 +29,7 @@ extern void generic_delete_func(void*);
 
 class Dictionary {
 public:
-	Dictionary(dict_order ordering = UNORDERED,
+	explicit Dictionary(dict_order ordering = UNORDERED,
 			int initial_size = DEFAULT_DICT_SIZE);
 	virtual ~Dictionary();
 
@@ -141,8 +141,8 @@ private:
 	int NextPrime(int n) const;
 	int IsPrime(int n) const;
 	void StartChangeSize(int new_size);
-	void FinishChangeSize(void);
-	void MoveChains(void);
+	void FinishChangeSize();
+	void MoveChains();
 
 	// The following get and set the "density" threshold - if the
 	// average hash chain length exceeds this threshold, the
@@ -195,7 +195,7 @@ private:
 #define PDictdeclare(type)	\
 class PDict(type) : public Dictionary {	\
 public:	\
-	PDict(type)(dict_order ordering = UNORDERED,	\
+	explicit PDict(type)(dict_order ordering = UNORDERED,	\
 			int initial_size = DEFAULT_DICT_SIZE) :	\
 		Dictionary(ordering, initial_size) {}	\
 	type* Lookup(const char* key) const	\
diff --git a/src/EquivClass.h b/src/EquivClass.h
index e5193cde47..7ac5931326 100644
--- a/src/EquivClass.h
+++ b/src/EquivClass.h
@@ -9,7 +9,7 @@
 
 class EquivClass {
 public:
-	EquivClass(int size);
+	explicit EquivClass(int size);
 	~EquivClass();
 
 	void UniqueChar(int sym);
diff --git a/src/Event.h b/src/Event.h
index 1b76928f10..d81a7717eb 100644
--- a/src/Event.h
+++ b/src/Event.h
@@ -16,7 +16,7 @@ public:
 	Event(EventHandlerPtr handler, val_list* args,
 		SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0,
 		TimerMgr* mgr = 0, BroObj* obj = 0);
-	~Event();
+	~Event() override;
 
 	void SetNext(Event* n)		{ next_event = n; }
 	Event* NextEvent() const	{ return next_event; }
@@ -27,7 +27,7 @@ public:
 	EventHandlerPtr Handler() const	{ return handler; }
 	val_list* Args() const	{ return args; }
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 
 protected:
 	friend class EventMgr;
@@ -78,9 +78,9 @@ extern uint64 num_events_dispatched;
 class EventMgr : public BroObj {
 public:
 	EventMgr();
-	~EventMgr();
+	~EventMgr() override;
 
-	void QueueEvent(EventHandlerPtr h, val_list* vl,
+	void QueueEvent(const EventHandlerPtr &h, val_list* vl,
 			SourceID src = SOURCE_LOCAL, analyzer::ID aid = 0,
 			TimerMgr* mgr = 0, BroObj* obj = 0)
 		{
@@ -118,7 +118,7 @@ public:
 	// Returns a peer record describing the local Bro.
 	RecordVal* GetLocalPeerVal();
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 
 protected:
 	void QueueEvent(Event* event);
diff --git a/src/EventHandler.h b/src/EventHandler.h
index 6006f2e48e..af5d561a46 100644
--- a/src/EventHandler.h
+++ b/src/EventHandler.h
@@ -17,7 +17,7 @@ class UnserialInfo;
 
 class EventHandler {
 public:
-	EventHandler(const char* name);
+	explicit EventHandler(const char* name);
 	~EventHandler();
 
 	const char* Name()	{ return name; }
@@ -44,7 +44,7 @@ public:
 	void Call(val_list* vl, bool no_remote = false);
 
 	// Returns true if there is at least one local or remote handler.
-	operator  bool() const;
+	explicit operator  bool() const;
 
 	void SetUsed()	{ used = true; }
 	bool Used()	{ return used; }
diff --git a/src/Expr.h b/src/Expr.h
index fb533b1469..d50506f493 100644
--- a/src/Expr.h
+++ b/src/Expr.h
@@ -63,7 +63,7 @@ public:
 	BroType* Type() const		{ return type; }
 	BroExprTag Tag() const	{ return tag; }
 
-	virtual ~Expr();
+	~Expr() override;
 
 	Expr* Ref()			{ ::Ref(this); return this; }
 
@@ -182,7 +182,7 @@ public:
 		return (AssignExpr*) this;
 		}
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 
 	bool Serialize(SerialInfo* info) const;
 	static Expr* Unserialize(UnserialInfo* info, BroExprTag want = EXPR_ANY);
@@ -191,7 +191,7 @@ public:
 
 protected:
 	Expr()	{ type = 0; }
-	Expr(BroExprTag arg_tag);
+	explicit Expr(BroExprTag arg_tag);
 
 	virtual void ExprDescribe(ODesc* d) const = 0;
 	void AddTag(ODesc* d) const;
@@ -215,8 +215,8 @@ protected:
 
 class NameExpr : public Expr {
 public:
-	NameExpr(ID* id, bool const_init = false);
-	~NameExpr();
+	explicit NameExpr(ID* id, bool const_init = false);
+	~NameExpr() override;
 
 	ID* Id() const		{ return id; }
 
@@ -241,8 +241,8 @@ protected:
 
 class ConstExpr : public Expr {
 public:
-	ConstExpr(Val* val);
-	~ConstExpr();
+	explicit ConstExpr(Val* val);
+	~ConstExpr() override;
 
 	Val* Value() const	{ return val; }
 
@@ -278,7 +278,7 @@ protected:
 	UnaryExpr()	{ op = 0; }
 
 	UnaryExpr(BroExprTag arg_tag, Expr* arg_op);
-	virtual ~UnaryExpr();
+	~UnaryExpr() override;
 
 	void ExprDescribe(ODesc* d) const override;
 
@@ -316,7 +316,7 @@ protected:
 		if ( op1->IsError() || op2->IsError() )
 			SetError();
 		}
-	virtual ~BinaryExpr();
+	~BinaryExpr() override;
 
 	// Returns the expression folded using the given constants.
 	virtual Val* Fold(Val* v1, Val* v2) const;
@@ -350,7 +350,7 @@ protected:
 
 class CloneExpr : public UnaryExpr {
 public:
-	CloneExpr(Expr* op);
+	explicit CloneExpr(Expr* op);
 	Val* Eval(Frame* f) const override;
 
 protected:
@@ -379,7 +379,7 @@ protected:
 
 class NotExpr : public UnaryExpr {
 public:
-	NotExpr(Expr* op);
+	explicit NotExpr(Expr* op);
 
 protected:
 	friend class Expr;
@@ -392,7 +392,7 @@ protected:
 
 class PosExpr : public UnaryExpr {
 public:
-	PosExpr(Expr* op);
+	explicit PosExpr(Expr* op);
 
 protected:
 	friend class Expr;
@@ -405,7 +405,7 @@ protected:
 
 class NegExpr : public UnaryExpr {
 public:
-	NegExpr(Expr* op);
+	explicit NegExpr(Expr* op);
 
 protected:
 	friend class Expr;
@@ -418,7 +418,7 @@ protected:
 
 class SizeExpr : public UnaryExpr {
 public:
-	SizeExpr(Expr* op);
+	explicit SizeExpr(Expr* op);
 	Val* Eval(Frame* f) const override;
 
 protected:
@@ -559,7 +559,7 @@ protected:
 class CondExpr : public Expr {
 public:
 	CondExpr(Expr* op1, Expr* op2, Expr* op3);
-	~CondExpr();
+	~CondExpr() override;
 
 	const Expr* Op1() const	{ return op1; }
 	const Expr* Op2() const	{ return op2; }
@@ -585,7 +585,7 @@ protected:
 
 class RefExpr : public UnaryExpr {
 public:
-	RefExpr(Expr* op);
+	explicit RefExpr(Expr* op);
 
 	void Assign(Frame* f, Val* v, Opcode op = OP_ASSIGN) override;
 	Expr* MakeLvalue() override;
@@ -602,7 +602,7 @@ public:
 	// If val is given, evaluating this expression will always yield the val
 	// yet still perform the assignment.  Used for triggers.
 	AssignExpr(Expr* op1, Expr* op2, int is_init, Val* val = 0, attr_list* attrs = 0);
-	virtual ~AssignExpr()	{ Unref(val); }
+	~AssignExpr() override { Unref(val); }
 
 	Val* Eval(Frame* f) const override;
 	void EvalIntoAggregate(const BroType* t, Val* aggr, Frame* f) const override;
@@ -657,7 +657,7 @@ protected:
 class FieldExpr : public UnaryExpr {
 public:
 	FieldExpr(Expr* op, const char* field_name);
-	~FieldExpr();
+	~FieldExpr() override;
 
 	int Field() const	{ return field; }
 	const char* FieldName() const	{ return field_name; }
@@ -689,7 +689,7 @@ protected:
 class HasFieldExpr : public UnaryExpr {
 public:
 	HasFieldExpr(Expr* op, const char* field_name);
-	~HasFieldExpr();
+	~HasFieldExpr() override;
 
 	const char* FieldName() const	{ return field_name; }
 
@@ -709,8 +709,8 @@ protected:
 
 class RecordConstructorExpr : public UnaryExpr {
 public:
-	RecordConstructorExpr(ListExpr* constructor_list);
-	~RecordConstructorExpr();
+	explicit RecordConstructorExpr(ListExpr* constructor_list);
+	~RecordConstructorExpr() override;
 
 protected:
 	friend class Expr;
@@ -728,7 +728,7 @@ class TableConstructorExpr : public UnaryExpr {
 public:
 	TableConstructorExpr(ListExpr* constructor_list, attr_list* attrs,
 	                     BroType* arg_type = 0);
-	~TableConstructorExpr()	{ Unref(attrs); }
+	~TableConstructorExpr() override { Unref(attrs); }
 
 	Attributes* Attrs() { return attrs; }
 
@@ -751,7 +751,7 @@ class SetConstructorExpr : public UnaryExpr {
 public:
 	SetConstructorExpr(ListExpr* constructor_list, attr_list* attrs,
 	                   BroType* arg_type = 0);
-	~SetConstructorExpr()	{ Unref(attrs); }
+	~SetConstructorExpr() override { Unref(attrs); }
 
 	Attributes* Attrs() { return attrs; }
 
@@ -772,7 +772,7 @@ protected:
 
 class VectorConstructorExpr : public UnaryExpr {
 public:
-	VectorConstructorExpr(ListExpr* constructor_list, BroType* arg_type = 0);
+	explicit VectorConstructorExpr(ListExpr* constructor_list, BroType* arg_type = 0);
 
 	Val* Eval(Frame* f) const override;
 
@@ -824,7 +824,7 @@ protected:
 class RecordCoerceExpr : public UnaryExpr {
 public:
 	RecordCoerceExpr(Expr* op, RecordType* r);
-	~RecordCoerceExpr();
+	~RecordCoerceExpr() override;
 
 protected:
 	friend class Expr;
@@ -844,7 +844,7 @@ protected:
 class TableCoerceExpr : public UnaryExpr {
 public:
 	TableCoerceExpr(Expr* op, TableType* r);
-	~TableCoerceExpr();
+	~TableCoerceExpr() override;
 
 protected:
 	friend class Expr;
@@ -858,7 +858,7 @@ protected:
 class VectorCoerceExpr : public UnaryExpr {
 public:
 	VectorCoerceExpr(Expr* op, VectorType* v);
-	~VectorCoerceExpr();
+	~VectorCoerceExpr() override;
 
 protected:
 	friend class Expr;
@@ -873,7 +873,7 @@ protected:
 // into a list of individual values.
 class FlattenExpr : public UnaryExpr {
 public:
-	FlattenExpr(Expr* op);
+	explicit FlattenExpr(Expr* op);
 
 protected:
 	friend class Expr;
@@ -892,9 +892,9 @@ class ScheduleTimer : public Timer {
 public:
 	ScheduleTimer(EventHandlerPtr event, val_list* args, double t,
 			TimerMgr* tmgr);
-	~ScheduleTimer();
+	~ScheduleTimer() override;
 
-	void Dispatch(double t, int is_expire);
+	void Dispatch(double t, int is_expire) override;
 
 protected:
 	EventHandlerPtr event;
@@ -905,7 +905,7 @@ protected:
 class ScheduleExpr : public Expr {
 public:
 	ScheduleExpr(Expr* when, EventExpr* event);
-	~ScheduleExpr();
+	~ScheduleExpr() override;
 
 	int IsPure() const override;
 
@@ -945,7 +945,7 @@ protected:
 class CallExpr : public Expr {
 public:
 	CallExpr(Expr* func, ListExpr* args, bool in_hook = false);
-	~CallExpr();
+	~CallExpr() override;
 
 	Expr* Func() const	{ return func; }
 	ListExpr* Args() const	{ return args; }
@@ -971,7 +971,7 @@ protected:
 class EventExpr : public Expr {
 public:
 	EventExpr(const char* name, ListExpr* args);
-	~EventExpr();
+	~EventExpr() override;
 
 	const char* Name() const	{ return name.c_str(); }
 	ListExpr* Args() const		{ return args; }
@@ -997,8 +997,8 @@ protected:
 class ListExpr : public Expr {
 public:
 	ListExpr();
-	ListExpr(Expr* e);
-	~ListExpr();
+	explicit ListExpr(Expr* e);
+	~ListExpr() override;
 
 	void Append(Expr* e);
 
diff --git a/src/File.h b/src/File.h
index 6410a67624..3660d3caa4 100644
--- a/src/File.h
+++ b/src/File.h
@@ -22,10 +22,10 @@ class RotateTimer;
 
 class BroFile : public BroObj {
 public:
-	BroFile(FILE* arg_f);
+	explicit BroFile(FILE* arg_f);
 	BroFile(FILE* arg_f, const char* filename, const char* access);
 	BroFile(const char* filename, const char* access, BroType* arg_t = 0);
-	virtual ~BroFile();
+	~BroFile() override;
 
 	const char* Name() const;
 
diff --git a/src/Frag.h b/src/Frag.h
index 7f3a0eec02..4d4ff1cccb 100644
--- a/src/Frag.h
+++ b/src/Frag.h
@@ -21,7 +21,7 @@ class FragReassembler : public Reassembler {
 public:
 	FragReassembler(NetSessions* s, const IP_Hdr* ip, const u_char* pkt,
 			HashKey* k, double t);
-	~FragReassembler();
+	~FragReassembler() override;
 
 	void AddFragment(double t, const IP_Hdr* ip, const u_char* pkt);
 
@@ -33,8 +33,8 @@ public:
 	HashKey* Key() const	{ return key; }
 
 protected:
-	void BlockInserted(DataBlock* start_block);
-	void Overlap(const u_char* b1, const u_char* b2, uint64 n);
+	void BlockInserted(DataBlock* start_block) override;
+	void Overlap(const u_char* b1, const u_char* b2, uint64 n) override;
 	void Weird(const char* name) const;
 
 	u_char* proto_hdr;
@@ -53,9 +53,9 @@ public:
 	FragTimer(FragReassembler* arg_f, double arg_t)
 		: Timer(arg_t, TIMER_FRAG)
 			{ f = arg_f; }
-	~FragTimer();
+	~FragTimer() override;
 
-	void Dispatch(double t, int is_expire);
+	void Dispatch(double t, int is_expire) override;
 
 	// Break the association between this timer and its creator.
 	void ClearReassembler()	{ f = 0; }
diff --git a/src/Frame.h b/src/Frame.h
index 0c22fa0e4e..1469543e10 100644
--- a/src/Frame.h
+++ b/src/Frame.h
@@ -15,7 +15,7 @@ class CallExpr;
 class Frame : public BroObj {
 public:
 	Frame(int size, const BroFunc* func, const val_list *fn_args);
-	~Frame();
+	~Frame() override;
 
 	Val* NthElement(int n)		{ return frame[n]; }
 	void SetElement(int n, Val* v)
@@ -27,7 +27,7 @@ public:
 	void Reset(int startIdx);
 	void Release();
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 
 	// For which function is this stack frame.
 	const BroFunc* GetFunction() const	{ return function; }
diff --git a/src/Func.h b/src/Func.h
index 791f8b7135..1c9e48549b 100644
--- a/src/Func.h
+++ b/src/Func.h
@@ -22,9 +22,9 @@ public:
 
 	enum Kind { BRO_FUNC, BUILTIN_FUNC };
 
-	Func(Kind arg_kind);
+	explicit Func(Kind arg_kind);
 
-	virtual ~Func();
+	~Func() override;
 
 	virtual int IsPure() const = 0;
 	function_flavor Flavor() const	{ return FType()->Flavor(); }
@@ -56,7 +56,7 @@ public:
 	const char* Name() const { return name.c_str(); }
 	void SetName(const char* arg_name)	{ name = arg_name; }
 
-	virtual void Describe(ODesc* d) const = 0;
+	void Describe(ODesc* d) const override = 0;
 	virtual void DescribeDebug(ODesc* d, const val_list* args) const;
 
 	// This (un-)serializes only a single body (as given in SerialInfo).
@@ -90,7 +90,7 @@ protected:
 class BroFunc : public Func {
 public:
 	BroFunc(ID* id, Stmt* body, id_list* inits, int frame_size, int priority);
-	~BroFunc();
+	~BroFunc() override;
 
 	int IsPure() const override;
 	Val* Call(val_list* args, Frame* parent) const override;
@@ -116,7 +116,7 @@ typedef Val* (*built_in_func)(Frame* frame, val_list* args);
 class BuiltinFunc : public Func {
 public:
 	BuiltinFunc(built_in_func func, const char* name, int is_pure);
-	~BuiltinFunc();
+	~BuiltinFunc() override;
 
 	int IsPure() const override;
 	Val* Call(val_list* args, Frame* parent) const override;
diff --git a/src/Hash.h b/src/Hash.h
index b8c998f461..922acdc74f 100644
--- a/src/Hash.h
+++ b/src/Hash.h
@@ -20,14 +20,14 @@ typedef enum {
 
 class HashKey {
 public:
-	HashKey(bro_int_t i);
-	HashKey(bro_uint_t u);
-	HashKey(uint32 u);
+	explicit HashKey(bro_int_t i);
+	explicit HashKey(bro_uint_t u);
+	explicit HashKey(uint32 u);
 	HashKey(const uint32 u[], int n);
-	HashKey(double d);
-	HashKey(const void* p);
-	HashKey(const char* s);
-	HashKey(const BroString* s);
+	explicit HashKey(double d);
+	explicit HashKey(const void* p);
+	explicit HashKey(const char* s);
+	explicit HashKey(const BroString* s);
 	~HashKey()
 		{
 		if ( is_our_dynamic )
diff --git a/src/ID.h b/src/ID.h
index 177adcdfde..442a13dfcc 100644
--- a/src/ID.h
+++ b/src/ID.h
@@ -19,7 +19,7 @@ typedef enum { SCOPE_FUNCTION, SCOPE_MODULE, SCOPE_GLOBAL } IDScope;
 class ID : public BroObj {
 public:
 	ID(const char* name, IDScope arg_scope, bool arg_is_export);
-	~ID();
+	~ID() override;
 
 	const char* Name() const	{ return name; }
 
diff --git a/src/IPAddr.h b/src/IPAddr.h
index cc7b2baa6e..8ff258a860 100644
--- a/src/IPAddr.h
+++ b/src/IPAddr.h
@@ -88,7 +88,7 @@ public:
 	 * @param s String containing an IP address as either a dotted IPv4
 	 * address or a hex IPv6 address.
 	 */
-	IPAddr(const BroString& s)
+	explicit IPAddr(const BroString& s)
 		{
 		Init(s.CheckString());
 		}
diff --git a/src/IntSet.h b/src/IntSet.h
index ef58e8b12f..5bbdf88d9b 100644
--- a/src/IntSet.h
+++ b/src/IntSet.h
@@ -12,7 +12,7 @@
 class IntSet {
 public:
 	// n is a hint for the value of the largest integer.
-	IntSet(unsigned int n = 1);
+	explicit IntSet(unsigned int n = 1);
 	~IntSet();
 
 	void Insert(unsigned int i);
diff --git a/src/List.h b/src/List.h
index bf87ade67d..fcc0274225 100644
--- a/src/List.h
+++ b/src/List.h
@@ -42,7 +42,7 @@ public:
 		{ return padded_sizeof(*this) + pad_size(max_entries * sizeof(ent)); }
 
 protected:
-	BaseList(int = 0);
+	explicit BaseList(int = 0);
 	BaseList(BaseList&);
 
 	void insert(ent);	// add at head of list
@@ -102,9 +102,9 @@ protected:
 #define Listdeclare(type)						\
 struct List(type) : BaseList						\
 	{								\
-	List(type)(type ...);						\
+	explicit List(type)(type ...);						\
 	List(type)() : BaseList(0) {}					\
-	List(type)(int sz) : BaseList(sz) {}				\
+	explicit List(type)(int sz) : BaseList(sz) {}				\
 	List(type)(List(type)& l) : BaseList((BaseList&)l) {}		\
 									\
 	void operator=(List(type)& l)					\
@@ -143,9 +143,9 @@ List(type)::List(type)(type e1 ...) : BaseList()			\
 #define PListdeclare(type)						\
 struct PList(type) : BaseList						\
 	{								\
-	PList(type)(type* ...);						\
+	explicit PList(type)(type* ...);						\
 	PList(type)() : BaseList(0) {}					\
-	PList(type)(int sz) : BaseList(sz) {}				\
+	explicit PList(type)(int sz) : BaseList(sz) {}				\
 	PList(type)(PList(type)& l) : BaseList((BaseList&)l) {}		\
 									\
 	void operator=(PList(type)& l)					\
diff --git a/src/NFA.h b/src/NFA.h
index 88ce3429c9..560f0930b4 100644
--- a/src/NFA.h
+++ b/src/NFA.h
@@ -27,8 +27,8 @@ typedef PList(NFA_State) NFA_state_list;
 class NFA_State : public BroObj  {
 public:
 	NFA_State(int sym, EquivClass* ec);
-	NFA_State(CCL* ccl);
-	~NFA_State();
+	explicit NFA_State(CCL* ccl);
+	~NFA_State() override;
 
 	void AddXtion(NFA_State* next_state)	{ xtions.append(next_state); }
 	NFA_state_list* Transitions()		{ return &xtions; }
@@ -52,7 +52,7 @@ public:
 
 	NFA_state_list* EpsilonClosure();
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 	void Dump(FILE* f);
 
 	// Recursivly count all the reachable states.
@@ -75,8 +75,8 @@ public:
 
 class NFA_Machine : public BroObj {
 public:
-	NFA_Machine(NFA_State* first, NFA_State* final = 0);
-	~NFA_Machine();
+	explicit NFA_Machine(NFA_State* first, NFA_State* final = 0);
+	~NFA_Machine() override;
 
 	NFA_State* FirstState() const	{ return first_state; }
 
@@ -103,7 +103,7 @@ public:
 	void AppendState(NFA_State* new_state);
 	void AppendMachine(NFA_Machine* new_mach);
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 	void Dump(FILE* f);
 
 	unsigned int MemoryAllocation() const
diff --git a/src/OSFinger.h b/src/OSFinger.h
index 2f0dde976b..b7c731900c 100644
--- a/src/OSFinger.h
+++ b/src/OSFinger.h
@@ -81,7 +81,7 @@ enum FingerprintMode {
 
 class OSFingerprint {
 public:
-	OSFingerprint(FingerprintMode mode);
+	explicit OSFingerprint(FingerprintMode mode);
 	~OSFingerprint()	{}
 
 	bool Error() const	{ return err; }
diff --git a/src/Obj.h b/src/Obj.h
index 59a1589afa..047eec0856 100644
--- a/src/Obj.h
+++ b/src/Obj.h
@@ -36,7 +36,7 @@ public:
 		text = 0;
 		}
 
-	virtual ~Location()
+	~Location() override
 		{
 		if ( delete_data )
 			delete [] filename;
@@ -112,7 +112,7 @@ public:
 			SetLocationInfo(&start_location, &end_location);
 		}
 
-	virtual ~BroObj();
+	~BroObj() override;
 
 	// Report user warnings/errors.  If obj2 is given, then it's
 	// included in the message, though if pinpoint_only is non-zero,
diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h
index 7954653c6c..61549f414a 100644
--- a/src/OpaqueVal.h
+++ b/src/OpaqueVal.h
@@ -23,7 +23,8 @@ public:
 
 protected:
 	HashVal() { };
-	HashVal(OpaqueType* t);
+	explicit HashVal(OpaqueType* t);
+
 	virtual bool DoInit();
 	virtual bool DoFeed(const void* data, size_t size);
 	virtual StringVal* DoGet();
@@ -48,9 +49,9 @@ public:
 protected:
 	friend class Val;
 
-	virtual bool DoInit() override;
-	virtual bool DoFeed(const void* data, size_t size) override;
-	virtual StringVal* DoGet() override;
+	bool DoInit() override;
+	bool DoFeed(const void* data, size_t size) override;
+	StringVal* DoGet() override;
 
 	DECLARE_SERIAL(MD5Val);
 
@@ -67,9 +68,9 @@ public:
 protected:
 	friend class Val;
 
-	virtual bool DoInit() override;
-	virtual bool DoFeed(const void* data, size_t size) override;
-	virtual StringVal* DoGet() override;
+	bool DoInit() override;
+	bool DoFeed(const void* data, size_t size) override;
+	StringVal* DoGet() override;
 
 	DECLARE_SERIAL(SHA1Val);
 
@@ -86,9 +87,9 @@ public:
 protected:
 	friend class Val;
 
-	virtual bool DoInit() override;
-	virtual bool DoFeed(const void* data, size_t size) override;
-	virtual StringVal* DoGet() override;
+	bool DoInit() override;
+	bool DoFeed(const void* data, size_t size) override;
+	StringVal* DoGet() override;
 
 	DECLARE_SERIAL(SHA256Val);
 
@@ -116,7 +117,7 @@ private:
 class BloomFilterVal : public OpaqueVal {
 public:
 	explicit BloomFilterVal(probabilistic::BloomFilter* bf);
-	virtual ~BloomFilterVal();
+	~BloomFilterVal() override;
 
 	BroType* Type() const;
 	bool Typify(BroType* type);
@@ -133,7 +134,7 @@ public:
 protected:
 	friend class Val;
 	BloomFilterVal();
-	BloomFilterVal(OpaqueType* t);
+	explicit BloomFilterVal(OpaqueType* t);
 
 	DECLARE_SERIAL(BloomFilterVal);
 
@@ -151,7 +152,7 @@ private:
 class CardinalityVal: public OpaqueVal {
 public:
 	explicit CardinalityVal(probabilistic::CardinalityCounter*);
-	virtual ~CardinalityVal();
+	~CardinalityVal() override;
 
 	void Add(const Val* val);
 
diff --git a/src/PacketDumper.h b/src/PacketDumper.h
index baace47876..080d9af724 100644
--- a/src/PacketDumper.h
+++ b/src/PacketDumper.h
@@ -12,7 +12,7 @@ using namespace std;
 
 class PacketDumper {
 public:
-	PacketDumper(pcap_dumper_t* pkt_dump);
+	explicit PacketDumper(pcap_dumper_t* pkt_dump);
 
 	void DumpPacket(const struct pcap_pkthdr* hdr,
 			const u_char* pkt, int len);
diff --git a/src/PacketFilter.h b/src/PacketFilter.h
index 3d7a3aa3be..6369a84323 100644
--- a/src/PacketFilter.h
+++ b/src/PacketFilter.h
@@ -8,7 +8,7 @@
 
 class PacketFilter {
 public:
-	PacketFilter(bool arg_default)	{ default_match = arg_default; }
+	explicit PacketFilter(bool arg_default)	{ default_match = arg_default; }
 	~PacketFilter()	{}
 
 	// Drops all packets from a particular source (which may be given
diff --git a/src/PersistenceSerializer.h b/src/PersistenceSerializer.h
index 7274e60569..99d8da88c4 100644
--- a/src/PersistenceSerializer.h
+++ b/src/PersistenceSerializer.h
@@ -11,7 +11,8 @@ class StateAccess;
 class PersistenceSerializer : public FileSerializer {
 public:
 	PersistenceSerializer();
-	virtual ~PersistenceSerializer();
+
+	~PersistenceSerializer() override;
 
 	// Define the directory where to store the data.
 	void SetDir(const char* arg_dir)	{ dir = copy_string(arg_dir); }
@@ -59,15 +60,15 @@ protected:
 	friend class RemoteSerializer;
 	friend class IncrementalWriteTimer;
 
-	virtual void GotID(ID* id, Val* val);
-	virtual void GotEvent(const char* name, double time,
-				EventHandlerPtr event, val_list* args);
-	virtual void GotFunctionCall(const char* name, double time,
-				Func* func, val_list* args) ;
-	virtual void GotStateAccess(StateAccess* s);
-	virtual void GotTimer(Timer* t);
-	virtual void GotConnection(Connection* c);
-	virtual void GotPacket(Packet* packet);
+	void GotID(ID* id, Val* val) override;
+	void GotEvent(const char* name, double time,
+				EventHandlerPtr event, val_list* args) override;
+	void GotFunctionCall(const char* name, double time,
+				Func* func, val_list* args) override;
+	void GotStateAccess(StateAccess* s) override;
+	void GotTimer(Timer* t) override;
+	void GotConnection(Connection* c) override;
+	void GotPacket(Packet* packet) override;
 
 	// If file has changed since last check, read it.
 	bool CheckForFile(UnserialInfo* info, const char* file,
diff --git a/src/Pipe.h b/src/Pipe.h
index 77b341117e..05153bfd4d 100644
--- a/src/Pipe.h
+++ b/src/Pipe.h
@@ -15,7 +15,7 @@ public:
 	 * @param status_flags0 descriptor status flags to set on read end of pipe.
 	 * @param status_flags1 descriptor status flags to set on write end of pipe.
 	 */
-	Pipe(int flags0 = 0, int flags1 = 0, int status_flags0 = 0,
+	explicit Pipe(int flags0 = 0, int flags1 = 0, int status_flags0 = 0,
 	     int status_flags1 = 0);
 
 	/**
diff --git a/src/PriorityQueue.h b/src/PriorityQueue.h
index 6fe36f43fe..e1700f5b38 100644
--- a/src/PriorityQueue.h
+++ b/src/PriorityQueue.h
@@ -10,7 +10,7 @@ class PriorityQueue;
 
 class PQ_Element {
 public:
-	PQ_Element(double t)	{ time = t; offset = -1; }
+	explicit PQ_Element(double t)	{ time = t; offset = -1; }
 	virtual ~PQ_Element()	{ }
 
 	double Time() const	{ return time; }
@@ -28,7 +28,7 @@ protected:
 
 class PriorityQueue {
 public:
-	PriorityQueue(int initial_size = 16);
+	explicit PriorityQueue(int initial_size = 16);
 	~PriorityQueue();
 
 	// Returns the top of queue, or nil if the queue is empty.
diff --git a/src/Queue.h b/src/Queue.h
index c9a69ad926..691b5b9908 100644
--- a/src/Queue.h
+++ b/src/Queue.h
@@ -39,7 +39,7 @@ public:
 	void incr(int& index)	{ index < max_entries ? ++index : index = 0; }
 
 protected:
-	BaseQueue(int = 0);
+	explicit BaseQueue(int = 0);
 
 	void push_front(ent);	// add in front of queue
 	void push_back(ent);	// add at end of queue
@@ -73,7 +73,7 @@ protected:
 struct Queue(type) : BaseQueue						\
 	{								\
 	Queue(type)() : BaseQueue(0) {}					\
-	Queue(type)(int sz) : BaseQueue(sz) {}				\
+	explicit Queue(type)(int sz) : BaseQueue(sz) {}				\
 									\
 	void push_front(type a)	{ BaseQueue::push_front(ent(a)); }	\
 	void push_back(type a)	{ BaseQueue::push_back(ent(a)); }	\
@@ -88,7 +88,7 @@ struct Queue(type) : BaseQueue						\
 struct PQueue(type) : BaseQueue						\
 	{								\
 	PQueue(type)() : BaseQueue(0) {}				\
-	PQueue(type)(int sz) : BaseQueue(sz) {}				\
+	explicit PQueue(type)(int sz) : BaseQueue(sz) {}				\
 									\
 	void push_front(type* a){ BaseQueue::push_front(ent(a)); }	\
 	void push_back(type* a)	{ BaseQueue::push_back(ent(a)); }	\
diff --git a/src/RE.h b/src/RE.h
index ad38aeb306..943751fddc 100644
--- a/src/RE.h
+++ b/src/RE.h
@@ -49,7 +49,7 @@ typedef enum { MATCH_ANYWHERE, MATCH_EXACTLY, } match_type;
 
 class Specific_RE_Matcher {
 public:
-	Specific_RE_Matcher(match_type mt, int multiline=0);
+	explicit Specific_RE_Matcher(match_type mt, int multiline=0);
 	~Specific_RE_Matcher();
 
 	void AddPat(const char* pat);
@@ -133,7 +133,7 @@ protected:
 
 class RE_Match_State {
 public:
-	RE_Match_State(Specific_RE_Matcher* matcher)
+	explicit RE_Match_State(Specific_RE_Matcher* matcher)
 		{
 		dfa = matcher->DFA() ? matcher->DFA() : 0;
 		ecs = matcher->EC()->EquivClasses();
@@ -172,8 +172,8 @@ protected:
 class RE_Matcher : SerialObj {
 public:
 	RE_Matcher();
-	RE_Matcher(const char* pat);
-	virtual ~RE_Matcher();
+	explicit RE_Matcher(const char* pat);
+	~RE_Matcher() override;
 
 	void AddPat(const char* pat);
 
diff --git a/src/Reassem.h b/src/Reassem.h
index 6b27d95678..501cd23a18 100644
--- a/src/Reassem.h
+++ b/src/Reassem.h
@@ -43,7 +43,7 @@ public:
 class Reassembler : public BroObj {
 public:
 	Reassembler(uint64 init_seq, ReassemblerType reassem_type = REASSEM_UNKNOWN);
-	virtual ~Reassembler();
+	~Reassembler() override;
 
 	void NewBlock(double t, uint64 seq, uint64 len, const u_char* data);
 
@@ -60,7 +60,7 @@ public:
 
 	uint64 TotalSize() const;	// number of bytes buffered up
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 
 	bool Serialize(SerialInfo* info) const;
 	static Reassembler* Unserialize(UnserialInfo* info);
diff --git a/src/RemoteSerializer.h b/src/RemoteSerializer.h
index 2af7610a7c..28ca495f17 100644
--- a/src/RemoteSerializer.h
+++ b/src/RemoteSerializer.h
@@ -25,7 +25,7 @@ namespace threading {
 class RemoteSerializer : public Serializer, public iosource::IOSource {
 public:
 	RemoteSerializer();
-	virtual ~RemoteSerializer();
+	~RemoteSerializer() override;
 
 	// Initialize the remote serializer (calling this will fork).
 	void Enable();
@@ -140,12 +140,12 @@ public:
 	void Finish();
 
 	// Overidden from IOSource:
-	virtual void GetFds(iosource::FD_Set* read, iosource::FD_Set* write,
-	                    iosource::FD_Set* except);
-	virtual double NextTimestamp(double* local_network_time);
-	virtual void Process();
-	virtual TimerMgr::Tag* GetCurrentTag();
-	virtual const char* Tag()	{ return "RemoteSerializer"; }
+	void GetFds(iosource::FD_Set* read, iosource::FD_Set* write,
+	                    iosource::FD_Set* except) override;
+	double NextTimestamp(double* local_network_time) override;
+	void Process() override;
+	TimerMgr::Tag* GetCurrentTag() override;
+	const char* Tag() override { return "RemoteSerializer"; }
 
 	// Gracefully finishes communication by first making sure that all
 	// remaining data (parent & child) has been sent out.
@@ -246,17 +246,17 @@ protected:
 
 	static void Log(LogLevel level, const char* msg, Peer* peer, LogSrc src = LogParent);
 
-	virtual void ReportError(const char* msg);
+	void ReportError(const char* msg) override;
 
-	virtual void GotEvent(const char* name, double time,
-				EventHandlerPtr event, val_list* args);
-	virtual void GotFunctionCall(const char* name, double time,
-				Func* func, val_list* args);
-	virtual void GotID(ID* id, Val* val);
-	virtual void GotStateAccess(StateAccess* s);
-	virtual void GotTimer(Timer* t);
-	virtual void GotConnection(Connection* c);
-	virtual void GotPacket(Packet* packet);
+	void GotEvent(const char* name, double time,
+				EventHandlerPtr event, val_list* args) override;
+	void GotFunctionCall(const char* name, double time,
+				Func* func, val_list* args) override;
+	void GotID(ID* id, Val* val) override;
+	void GotStateAccess(StateAccess* s) override;
+	void GotTimer(Timer* t) override;
+	void GotConnection(Connection* c) override;
+	void GotPacket(Packet* packet) override;
 
 	void Fork();
 
diff --git a/src/RuleAction.h b/src/RuleAction.h
index 7b5a76fad5..8499065ea0 100644
--- a/src/RuleAction.h
+++ b/src/RuleAction.h
@@ -24,13 +24,13 @@ public:
 // Implements the "event" keyword.
 class RuleActionEvent : public RuleAction {
 public:
-	RuleActionEvent(const char* arg_msg)	{ msg = copy_string(arg_msg); }
-	virtual ~RuleActionEvent()	{ delete [] msg; }
+	explicit RuleActionEvent(const char* arg_msg)	{ msg = copy_string(arg_msg); }
+	~RuleActionEvent() override { delete [] msg; }
 
-	virtual void DoAction(const Rule* parent, RuleEndpointState* state,
-				const u_char* data, int len);
+	void DoAction(const Rule* parent, RuleEndpointState* state,
+				const u_char* data, int len) override;
 
-	virtual void PrintDebug();
+	void PrintDebug() override;
 
 private:
 	const char* msg;
@@ -38,17 +38,17 @@ private:
 
 class RuleActionMIME : public RuleAction {
 public:
-	RuleActionMIME(const char* arg_mime, int arg_strength = 0)
+	explicit RuleActionMIME(const char* arg_mime, int arg_strength = 0)
 		{ mime = copy_string(arg_mime); strength = arg_strength; }
 
-	virtual ~RuleActionMIME()
+	~RuleActionMIME() override
 		{ delete [] mime; }
 
-	virtual void DoAction(const Rule* parent, RuleEndpointState* state,
-	                      const u_char* data, int len)
+	void DoAction(const Rule* parent, RuleEndpointState* state,
+	                      const u_char* data, int len) override
 		{ }
 
-	virtual void PrintDebug();
+	void PrintDebug() override;
 
 	string GetMIME() const
 		{ return mime; }
@@ -64,12 +64,12 @@ private:
 // Base class for enable/disable actions.
 class RuleActionAnalyzer : public RuleAction {
 public:
-	RuleActionAnalyzer(const char* analyzer);
+	explicit RuleActionAnalyzer(const char* analyzer);
 
-	virtual void DoAction(const Rule* parent, RuleEndpointState* state,
-			      const u_char* data, int len) = 0;
+	void DoAction(const Rule* parent, RuleEndpointState* state,
+			      const u_char* data, int len) override = 0;
 
-	virtual void PrintDebug();
+	void PrintDebug() override;
 
 	analyzer::Tag Analyzer() const { return analyzer; }
 	analyzer::Tag ChildAnalyzer() const { return child_analyzer; }
@@ -81,22 +81,22 @@ private:
 
 class RuleActionEnable : public RuleActionAnalyzer {
 public:
-	RuleActionEnable(const char* analyzer) : RuleActionAnalyzer(analyzer)	{}
+	explicit RuleActionEnable(const char* analyzer) : RuleActionAnalyzer(analyzer)	{}
 
-	virtual void DoAction(const Rule* parent, RuleEndpointState* state,
-				const u_char* data, int len);
+	void DoAction(const Rule* parent, RuleEndpointState* state,
+				const u_char* data, int len) override;
 
-	virtual void PrintDebug();
+	void PrintDebug() override;
 };
 
 class RuleActionDisable : public RuleActionAnalyzer {
 public:
-	RuleActionDisable(const char* analyzer) : RuleActionAnalyzer(analyzer)	{}
+	explicit RuleActionDisable(const char* analyzer) : RuleActionAnalyzer(analyzer)	{}
 
-	virtual void DoAction(const Rule* parent, RuleEndpointState* state,
-				const u_char* data, int len);
+	void DoAction(const Rule* parent, RuleEndpointState* state,
+				const u_char* data, int len) override;
 
-	virtual void PrintDebug();
+	void PrintDebug() override;
 };
 
 #endif
diff --git a/src/RuleCondition.h b/src/RuleCondition.h
index b859930581..4b1fbf6c57 100644
--- a/src/RuleCondition.h
+++ b/src/RuleCondition.h
@@ -31,15 +31,15 @@ public:
 		STATE_STATELESS = 8
 	};
 
-	RuleConditionTCPState(int arg_tcpstates)
+	explicit RuleConditionTCPState(int arg_tcpstates)
 		{ tcpstates = arg_tcpstates; }
 
-	virtual ~RuleConditionTCPState()	{ }
+	~RuleConditionTCPState() override { }
 
-	virtual bool DoMatch(Rule* rule, RuleEndpointState* state,
-				const u_char* data, int len);
+	bool DoMatch(Rule* rule, RuleEndpointState* state,
+				const u_char* data, int len) override;
 
-	virtual void PrintDebug();
+	void PrintDebug() override;
 
 private:
 	int tcpstates;
@@ -56,13 +56,15 @@ public:
 		OPT_SSRR = 8,
 	};
 
-	RuleConditionIPOptions(int arg_options)	{ options = arg_options; }
-	virtual ~RuleConditionIPOptions()	{ }
+	explicit RuleConditionIPOptions(int arg_options)	{ options = arg_options; }
 
-	virtual bool DoMatch(Rule* rule, RuleEndpointState* state,
-				const u_char* data, int len);
+	~RuleConditionIPOptions() override
+		{ }
 
-	virtual void PrintDebug();
+	bool DoMatch(Rule* rule, RuleEndpointState* state,
+				const u_char* data, int len) override;
+
+	void PrintDebug() override;
 
 private:
 	int options;
@@ -72,12 +74,12 @@ private:
 class RuleConditionSameIP : public RuleCondition {
 public:
 	RuleConditionSameIP()	{ }
-	virtual ~RuleConditionSameIP()	{}
+	~RuleConditionSameIP() override {}
 
-	virtual bool DoMatch(Rule* rule, RuleEndpointState* state,
-				const u_char* data, int len);
+	bool DoMatch(Rule* rule, RuleEndpointState* state,
+				const u_char* data, int len) override;
 
-	virtual void PrintDebug();
+	void PrintDebug() override;
 };
 
 // Implements "payload-size".
@@ -88,12 +90,12 @@ public:
 	RuleConditionPayloadSize(uint32 arg_val, Comp arg_comp)
 		{ val = arg_val; comp = arg_comp; }
 
-	virtual ~RuleConditionPayloadSize()	{}
+	~RuleConditionPayloadSize() override {}
 
-	virtual bool DoMatch(Rule* rule, RuleEndpointState* state,
-				const u_char* data, int len);
+	bool DoMatch(Rule* rule, RuleEndpointState* state,
+				const u_char* data, int len) override;
 
-	virtual void PrintDebug();
+	void PrintDebug() override;
 
 private:
 	uint32 val;
@@ -103,13 +105,13 @@ private:
 // Implements "eval" which evaluates the given Bro identifier.
 class RuleConditionEval : public RuleCondition {
 public:
-	RuleConditionEval(const char* func);
-	virtual ~RuleConditionEval() {}
+	explicit RuleConditionEval(const char* func);
+	~RuleConditionEval() override {}
 
-	virtual bool DoMatch(Rule* rule, RuleEndpointState* state,
-				const u_char* data, int len);
+	bool DoMatch(Rule* rule, RuleEndpointState* state,
+				const u_char* data, int len) override;
 
-	virtual void PrintDebug();
+	void PrintDebug() override;
 private:
 	ID* id;
 };
diff --git a/src/Scope.h b/src/Scope.h
index 265d624a66..0e8e81c1a5 100644
--- a/src/Scope.h
+++ b/src/Scope.h
@@ -19,8 +19,8 @@ declare(PDict,ID);
 
 class Scope : public BroObj {
 public:
-	Scope(ID* id);
-	~Scope();
+	explicit Scope(ID* id);
+	~Scope() override;
 
 	ID* Lookup(const char* name) const	{ return local->Lookup(name); }
 	void Insert(const char* name, ID* id)	{ local->Insert(name, id); }
@@ -47,7 +47,7 @@ public:
 	// Adds a variable to the list.
 	void AddInit(ID* id)		{ inits->append(id); }
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const;
 
diff --git a/src/SerialObj.h b/src/SerialObj.h
index ca661db8af..77dc28aefd 100644
--- a/src/SerialObj.h
+++ b/src/SerialObj.h
@@ -163,16 +163,16 @@ public:
 // Macro helpers.
 
 #define DECLARE_ABSTRACT_SERIAL(classname) \
-	virtual bool DoSerialize(SerialInfo*) const; \
-	virtual bool DoUnserialize(UnserialInfo*); \
+	bool DoSerialize(SerialInfo*) const override; \
+	bool DoUnserialize(UnserialInfo*) override; \
 
 #define DECLARE_SERIAL(classname) \
 	static classname* Instantiate(); \
 	static SerialTypeRegistrator register_type; \
-	virtual bool DoSerialize(SerialInfo*) const override; \
-	virtual bool DoUnserialize(UnserialInfo*) override; \
-	virtual const TransientID*  GetTID() const override	{ return &tid; } \
-	virtual SerialType GetSerialType() const override; \
+	bool DoSerialize(SerialInfo*) const override; \
+	bool DoUnserialize(UnserialInfo*) override; \
+	const TransientID*  GetTID() const override	{ return &tid; } \
+	SerialType GetSerialType() const override; \
 	TransientID tid;
 
 // Only needed (and usable) for non-abstract classes.
diff --git a/src/SerializationFormat.h b/src/SerializationFormat.h
index 3a6a578653..1248b7f74b 100644
--- a/src/SerializationFormat.h
+++ b/src/SerializationFormat.h
@@ -98,40 +98,40 @@ protected:
 class BinarySerializationFormat : public SerializationFormat {
 public:
 	BinarySerializationFormat();
-	virtual ~BinarySerializationFormat();
+	~BinarySerializationFormat() override;
 
-	virtual bool Read(int* v, const char* tag);
-	virtual bool Read(uint16* v, const char* tag);
-	virtual bool Read(uint32* v, const char* tag);
-	virtual bool Read(int64* v, const char* tag);
-	virtual bool Read(uint64* v, const char* tag);
-	virtual bool Read(char* v, const char* tag);
-	virtual bool Read(bool* v, const char* tag);
-	virtual bool Read(double* d, const char* tag);
-	virtual bool Read(char** str, int* len, const char* tag);
-	virtual bool Read(string* s, const char* tag);
-	virtual bool Read(IPAddr* addr, const char* tag);
-	virtual bool Read(IPPrefix* prefix, const char* tag);
-	virtual bool Read(struct in_addr* addr, const char* tag);
-	virtual bool Read(struct in6_addr* addr, const char* tag);
-	virtual bool Write(int v, const char* tag);
-	virtual bool Write(uint16 v, const char* tag);
-	virtual bool Write(uint32 v, const char* tag);
-	virtual bool Write(int64 v, const char* tag);
-	virtual bool Write(uint64 v, const char* tag);
-	virtual bool Write(char v, const char* tag);
-	virtual bool Write(bool v, const char* tag);
-	virtual bool Write(double d, const char* tag);
-	virtual bool Write(const char* s, const char* tag);
-	virtual bool Write(const char* buf, int len, const char* tag);
-	virtual bool Write(const string& s, const char* tag);
-	virtual bool Write(const IPAddr& addr, const char* tag);
-	virtual bool Write(const IPPrefix& prefix, const char* tag);
-	virtual bool Write(const struct in_addr& addr, const char* tag);
-	virtual bool Write(const struct in6_addr& addr, const char* tag);
-	virtual bool WriteOpenTag(const char* tag);
-	virtual bool WriteCloseTag(const char* tag);
-	virtual bool WriteSeparator();
+	bool Read(int* v, const char* tag) override;
+	bool Read(uint16* v, const char* tag) override;
+	bool Read(uint32* v, const char* tag) override;
+	bool Read(int64* v, const char* tag) override;
+	bool Read(uint64* v, const char* tag) override;
+	bool Read(char* v, const char* tag) override;
+	bool Read(bool* v, const char* tag) override;
+	bool Read(double* d, const char* tag) override;
+	bool Read(char** str, int* len, const char* tag) override;
+	bool Read(string* s, const char* tag) override;
+	bool Read(IPAddr* addr, const char* tag) override;
+	bool Read(IPPrefix* prefix, const char* tag) override;
+	bool Read(struct in_addr* addr, const char* tag) override;
+	bool Read(struct in6_addr* addr, const char* tag) override;
+	bool Write(int v, const char* tag) override;
+	bool Write(uint16 v, const char* tag) override;
+	bool Write(uint32 v, const char* tag) override;
+	bool Write(int64 v, const char* tag) override;
+	bool Write(uint64 v, const char* tag) override;
+	bool Write(char v, const char* tag) override;
+	bool Write(bool v, const char* tag) override;
+	bool Write(double d, const char* tag) override;
+	bool Write(const char* s, const char* tag) override;
+	bool Write(const char* buf, int len, const char* tag) override;
+	bool Write(const string& s, const char* tag) override;
+	bool Write(const IPAddr& addr, const char* tag) override;
+	bool Write(const IPPrefix& prefix, const char* tag) override;
+	bool Write(const struct in_addr& addr, const char* tag) override;
+	bool Write(const struct in6_addr& addr, const char* tag) override;
+	bool WriteOpenTag(const char* tag) override;
+	bool WriteCloseTag(const char* tag) override;
+	bool WriteSeparator() override;
 };
 
 #endif
diff --git a/src/Serializer.h b/src/Serializer.h
index 7f31e27d55..3b863a5b6e 100644
--- a/src/Serializer.h
+++ b/src/Serializer.h
@@ -96,7 +96,7 @@ public:
 
 protected:
 	// Format defaults to binary serialization.
-	Serializer(SerializationFormat* format = 0);
+	explicit Serializer(SerializationFormat* format = 0);
 	virtual ~Serializer();
 
 	// Reads next object.
@@ -159,7 +159,7 @@ public:
 
 	// If max_cache_size is greater than zero, we'll remove old entries
 	// automatically if limit is reached (LRU expiration).
-	SerializationCache(unsigned int max_cache_size = 0);
+	explicit SerializationCache(unsigned int max_cache_size = 0);
 	~SerializationCache();
 
 	PermanentID Register(const SerialObj* obj, PermanentID pid,
@@ -261,27 +261,27 @@ private:
 // minimal implementation of Serializer!
 class CloneSerializer : public Serializer {
 public:
-	CloneSerializer(SerializationFormat* format = 0) : Serializer(format) { }
-	virtual ~CloneSerializer()	{ }
+	explicit CloneSerializer(SerializationFormat* format = 0) : Serializer(format) { }
+	~CloneSerializer() override
+		{ }
 
 protected:
-	virtual void ReportError(const char* msg)	{ reporter->Error("%s", msg); }
-	virtual void GotID(ID* id, Val* val)	{ }
-	virtual void GotEvent(const char* name, double time,
-				EventHandlerPtr event, val_list* args)	{ }
-	virtual void GotFunctionCall(const char* name, double time,
-				Func* func, val_list* args)	{ }
-	virtual void GotStateAccess(StateAccess* s)	{ delete s; }
-	virtual void GotTimer(Timer* t)	{ }
-	virtual void GotConnection(Connection* c)	{ }
-	virtual void GotPacket(Packet* packet)	{ }
+	void ReportError(const char* msg) override { reporter->Error("%s", msg); }
+	void GotID(ID* id, Val* val) override { }
+	void GotEvent(const char* name, double time, EventHandlerPtr event, val_list* args) override { }
+	void GotFunctionCall(const char* name, double time,
+				Func* func, val_list* args) override { }
+	void GotStateAccess(StateAccess* s) override { delete s; }
+	void GotTimer(Timer* t) override { }
+	void GotConnection(Connection* c) override { }
+	void GotPacket(Packet* packet) override { }
 };
 
 // Write values/events to file or fd.
 class FileSerializer : public Serializer {
 public:
-	FileSerializer(SerializationFormat* format = 0);
-	virtual ~FileSerializer();
+	explicit FileSerializer(SerializationFormat* format = 0);
+	~FileSerializer() override;
 
 	// Opens the file for serialization.
 	bool Open(const char* file, bool pure = false);
@@ -291,16 +291,16 @@ public:
 	bool Read(UnserialInfo* info, const char* file, bool header = true);
 
 protected:
-	virtual void ReportError(const char* msg);
-	virtual void GotID(ID* id, Val* val);
-	virtual void GotEvent(const char* name, double time,
-				EventHandlerPtr event, val_list* args);
-	virtual void GotFunctionCall(const char* name, double time,
-				Func* func, val_list* args);
-	virtual void GotStateAccess(StateAccess* s);
-	virtual void GotTimer(Timer* t);
-	virtual void GotConnection(Connection* c);
-	virtual void GotPacket(Packet* packet);
+	void ReportError(const char* msg) override;
+	void GotID(ID* id, Val* val) override;
+	void GotEvent(const char* name, double time,
+				EventHandlerPtr event, val_list* args) override;
+	void GotFunctionCall(const char* name, double time,
+				Func* func, val_list* args) override;
+	void GotStateAccess(StateAccess* s) override;
+	void GotTimer(Timer* t) override;
+	void GotConnection(Connection* c) override;
+	void GotPacket(Packet* packet) override;
 
 	bool OpenFile(const char* file, bool readonly, bool should_exist = false);
 	void CloseFile();
@@ -331,21 +331,21 @@ public:
 // Plays a file of events back.
 class EventPlayer : public FileSerializer, public iosource::IOSource {
 public:
-	EventPlayer(const char* file);
-	virtual ~EventPlayer();
+	explicit EventPlayer(const char* file);
+	~EventPlayer() override;
 
-	virtual void GetFds(iosource::FD_Set* read, iosource::FD_Set* write,
-	                    iosource::FD_Set* except);
-	virtual double NextTimestamp(double* local_network_time);
-	virtual void Process();
-	virtual const char* Tag()	{ return "EventPlayer"; }
+	void GetFds(iosource::FD_Set* read, iosource::FD_Set* write,
+	                    iosource::FD_Set* except) override;
+	double NextTimestamp(double* local_network_time) override;
+	void Process() override;
+	const char* Tag() override { return "EventPlayer"; }
 
 protected:
-	virtual void GotID(ID* id, Val* val)	{}
-	virtual void GotEvent(const char* name, double time,
-				EventHandlerPtr event, val_list* args);
-	virtual void GotFunctionCall(const char* name, double time,
-				Func* func, val_list* args);
+	void GotID(ID* id, Val* val) override {}
+	void GotEvent(const char* name, double time,
+				EventHandlerPtr event, val_list* args) override;
+	void GotFunctionCall(const char* name, double time,
+				Func* func, val_list* args) override;
 
 	double stream_time;	// time of first captured event
 	double replay_time;	// network time of replay start
diff --git a/src/Sessions.h b/src/Sessions.h
index 37fa81016e..915b2f5631 100644
--- a/src/Sessions.h
+++ b/src/Sessions.h
@@ -56,7 +56,7 @@ public:
 	    : Timer(t, TIMER_TIMERMGR_EXPIRE), mgr(arg_mgr)
 		{ }
 
-	virtual void Dispatch(double t, int is_expire);
+	void Dispatch(double t, int is_expire) override;
 
 protected:
 	TimerMgr* mgr;
@@ -260,9 +260,9 @@ public:
 	: Timer(t + BifConst::Tunnel::ip_tunnel_timeout,
 			TIMER_IP_TUNNEL_INACTIVITY), tunnel_idx(p) {}
 
-	~IPTunnelTimer() {}
+	~IPTunnelTimer() override {}
 
-	void Dispatch(double t, int is_expire);
+	void Dispatch(double t, int is_expire) override;
 
 protected:
 	NetSessions::IPPair tunnel_idx;
diff --git a/src/SmithWaterman.h b/src/SmithWaterman.h
index 190ecda597..2eb359dec0 100644
--- a/src/SmithWaterman.h
+++ b/src/SmithWaterman.h
@@ -41,10 +41,10 @@ public:
 	typedef BSSAlignVec::iterator BSSAlignVecIt;
 	typedef BSSAlignVec::const_iterator BSSAlignVecCIt;
 
-	BroSubstring(const string& string)
+	explicit BroSubstring(const string& string)
 		: BroString(string), _num(), _new(false) { }
 
-	BroSubstring(const BroString& string)
+	explicit BroSubstring(const BroString& string)
 		: BroString(string), _num(), _new(false) { }
 
 	BroSubstring(const BroSubstring& bst);
@@ -97,7 +97,7 @@ private:
 //
 class BroSubstringCmp {
 public:
-	BroSubstringCmp(unsigned int index)	{ _index = index; }
+	explicit BroSubstringCmp(unsigned int index)	{ _index = index; }
 	bool operator()(const BroSubstring* bst1, const BroSubstring* bst2) const;
 
  private:
@@ -119,7 +119,7 @@ enum SWVariant {
 // Parameters for Smith-Waterman are stored in this simple record.
 //
 struct SWParams {
-	SWParams(unsigned int min_toklen = 3, SWVariant sw_variant = SW_SINGLE)
+	explicit SWParams(unsigned int min_toklen = 3, SWVariant sw_variant = SW_SINGLE)
 		{
 		_min_toklen = min_toklen;
 		_sw_variant = sw_variant;
diff --git a/src/StateAccess.h b/src/StateAccess.h
index bc5064602b..1e84430956 100644
--- a/src/StateAccess.h
+++ b/src/StateAccess.h
@@ -48,7 +48,7 @@ public:
 
 	StateAccess(const StateAccess& sa);
 
-	virtual ~StateAccess();
+	~StateAccess() override;
 
 	// Replays this access in the our environment.
 	void Replay();
diff --git a/src/Stats.h b/src/Stats.h
index 7fbec8cab6..af9a0e1f3c 100644
--- a/src/Stats.h
+++ b/src/Stats.h
@@ -63,14 +63,14 @@ protected:
 class ProfileLogger : public SegmentStatsReporter {
 public:
 	ProfileLogger(BroFile* file, double interval);
-	~ProfileLogger();
+	~ProfileLogger() override;
 
 	void Log();
 	BroFile* File()	{ return file; }
 
 protected:
 	void SegmentProfile(const char* name, const Location* loc,
-				double dtime, int dmem);
+				double dtime, int dmem) override;
 
 private:
 	BroFile* file;
@@ -82,7 +82,7 @@ private:
 class SampleLogger : public SegmentStatsReporter {
 public:
 	SampleLogger();
-	~SampleLogger();
+	~SampleLogger() override;
 
 	// These are called to report that a given function or location
 	// has been seen during the sampling.
@@ -91,7 +91,7 @@ public:
 
 protected:
 	void SegmentProfile(const char* name, const Location* loc,
-				double dtime, int dmem);
+				double dtime, int dmem) override;
 
 	TableVal* load_samples;
 };
diff --git a/src/Stmt.h b/src/Stmt.h
index 1c3bef2984..7fed08ed33 100644
--- a/src/Stmt.h
+++ b/src/Stmt.h
@@ -23,15 +23,15 @@ class Stmt : public BroObj {
 public:
 	BroStmtTag Tag() const	{ return tag; }
 
-	virtual ~Stmt();
+	~Stmt() override;
 
 	virtual Val* Exec(Frame* f, stmt_flow_type& flow) const = 0;
 
 	Stmt* Ref()			{ ::Ref(this); return this; }
 
-	bool SetLocationInfo(const Location* loc)
+	bool SetLocationInfo(const Location* loc) override
 		{ return Stmt::SetLocationInfo(loc, loc); }
-	bool SetLocationInfo(const Location* start, const Location* end);
+	bool SetLocationInfo(const Location* start, const Location* end) override;
 
 	// True if the statement has no side effects, false otherwise.
 	virtual int IsPure() const;
@@ -58,7 +58,7 @@ public:
 	void AccessStats(ODesc* d) const;
 	uint32 GetAccessCount() const { return access_count; }
 
-	virtual void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 
 	virtual void IncrBPCount()	{ ++breakpoint_count; }
 	virtual void DecrBPCount()
@@ -78,7 +78,7 @@ public:
 
 protected:
 	Stmt()	{}
-	Stmt(BroStmtTag arg_tag);
+	explicit Stmt(BroStmtTag arg_tag);
 
 	void AddTag(ODesc* d) const;
 	void DescribeDone(ODesc* d) const;
@@ -97,18 +97,18 @@ class ExprListStmt : public Stmt {
 public:
 	const ListExpr* ExprList() const	{ return l; }
 
-	TraversalCode Traverse(TraversalCallback* cb) const;
+	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
 	ExprListStmt()	{ l = 0; }
 	ExprListStmt(BroStmtTag t, ListExpr* arg_l);
 
-	virtual ~ExprListStmt();
+	~ExprListStmt() override;
 
-	Val* Exec(Frame* f, stmt_flow_type& flow) const;
+	Val* Exec(Frame* f, stmt_flow_type& flow) const override;
 	virtual Val* DoExec(val_list* vals, stmt_flow_type& flow) const = 0;
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 	void PrintVals(ODesc* d, val_list* vals, int offset) const;
 
 	DECLARE_ABSTRACT_SERIAL(ExprListStmt);
@@ -118,7 +118,7 @@ protected:
 
 class PrintStmt : public ExprListStmt {
 public:
-	PrintStmt(ListExpr* l) : ExprListStmt(STMT_PRINT, l)	{ }
+	explicit PrintStmt(ListExpr* l) : ExprListStmt(STMT_PRINT, l)	{ }
 
 protected:
 	friend class Stmt;
@@ -131,8 +131,8 @@ protected:
 
 class ExprStmt : public Stmt {
 public:
-	ExprStmt(Expr* e);
-	virtual ~ExprStmt();
+	explicit ExprStmt(Expr* e);
+	~ExprStmt() override;
 
 	Val* Exec(Frame* f, stmt_flow_type& flow) const override;
 
@@ -159,7 +159,7 @@ protected:
 class IfStmt : public ExprStmt {
 public:
 	IfStmt(Expr* test, Stmt* s1, Stmt* s2);
-	~IfStmt();
+	~IfStmt() override;
 
 	const Stmt* TrueBranch() const	{ return s1; }
 	const Stmt* FalseBranch() const	{ return s2; }
@@ -184,7 +184,7 @@ protected:
 class Case : public BroObj {
 public:
 	Case(ListExpr* c, Stmt* arg_s);
-	~Case();
+	~Case() override;
 
 	const ListExpr* Cases() const	{ return cases; }
 	ListExpr* Cases()		{ return cases; }
@@ -212,7 +212,7 @@ protected:
 class SwitchStmt : public ExprStmt {
 public:
 	SwitchStmt(Expr* index, case_list* cases);
-	~SwitchStmt();
+	~SwitchStmt() override;
 
 	const case_list* Cases() const	{ return cases; }
 
@@ -250,7 +250,7 @@ protected:
 
 class AddStmt : public ExprStmt {
 public:
-	AddStmt(Expr* e);
+	explicit AddStmt(Expr* e);
 
 	int IsPure() const override;
 	Val* Exec(Frame* f, stmt_flow_type& flow) const override;
@@ -266,7 +266,7 @@ protected:
 
 class DelStmt : public ExprStmt {
 public:
-	DelStmt(Expr* e);
+	explicit DelStmt(Expr* e);
 
 	int IsPure() const override;
 	Val* Exec(Frame* f, stmt_flow_type& flow) const override;
@@ -282,7 +282,7 @@ protected:
 
 class EventStmt : public ExprStmt {
 public:
-	EventStmt(EventExpr* e);
+	explicit EventStmt(EventExpr* e);
 
 	Val* Exec(Frame* f, stmt_flow_type& flow) const override;
 
@@ -301,7 +301,7 @@ class WhileStmt : public Stmt {
 public:
 
 	WhileStmt(Expr* loop_condition, Stmt* body);
-	~WhileStmt();
+	~WhileStmt() override;
 
 	int IsPure() const override;
 
@@ -326,7 +326,7 @@ protected:
 class ForStmt : public ExprStmt {
 public:
 	ForStmt(id_list* loop_vars, Expr* loop_expr);
-	~ForStmt();
+	~ForStmt() override;
 
 	void AddBody(Stmt* arg_body)	{ body = arg_body; }
 
@@ -399,7 +399,7 @@ protected:
 
 class ReturnStmt : public ExprStmt {
 public:
-	ReturnStmt(Expr* e);
+	explicit ReturnStmt(Expr* e);
 
 	Val* Exec(Frame* f, stmt_flow_type& flow) const override;
 
@@ -415,7 +415,7 @@ protected:
 class StmtList : public Stmt {
 public:
 	StmtList();
-	~StmtList();
+	~StmtList() override;
 
 	Val* Exec(Frame* f, stmt_flow_type& flow) const override;
 
@@ -456,14 +456,14 @@ protected:
 
 class InitStmt : public Stmt {
 public:
-	InitStmt(id_list* arg_inits) : Stmt(STMT_INIT)
+	explicit InitStmt(id_list* arg_inits) : Stmt(STMT_INIT)
 		{
 		inits = arg_inits;
 		if ( arg_inits && arg_inits->length() )
 			SetLocationInfo((*arg_inits)[0]->GetLocationInfo());
 		}
 
-	~InitStmt();
+	~InitStmt() override;
 
 	Val* Exec(Frame* f, stmt_flow_type& flow) const override;
 
@@ -501,7 +501,7 @@ class WhenStmt : public Stmt {
 public:
 	// s2 is null if no timeout block given.
 	WhenStmt(Expr* cond, Stmt* s1, Stmt* s2, Expr* timeout, bool is_return);
-	~WhenStmt();
+	~WhenStmt() override;
 
 	Val* Exec(Frame* f, stmt_flow_type& flow) const override;
 	int IsPure() const override;
diff --git a/src/Tag.h b/src/Tag.h
index 224fdd40f3..efc3e359c2 100644
--- a/src/Tag.h
+++ b/src/Tag.h
@@ -132,7 +132,7 @@ protected:
 	 *
 	 * @param val An enum value of script type \c Analyzer::Tag.
 	 */
-	Tag(EnumVal* val);
+	explicit Tag(EnumVal* val);
 
 private:
 	type_t type;            // Main type.
diff --git a/src/Timer.h b/src/Timer.h
index 8fba53d3b7..ea410e5c7b 100644
--- a/src/Timer.h
+++ b/src/Timer.h
@@ -56,7 +56,7 @@ class Timer : public SerialObj, public PQ_Element {
 public:
 	Timer(double t, TimerType arg_type) : PQ_Element(t)
 		{ type = (char) arg_type; }
-	virtual ~Timer()	{ }
+	~Timer() override { }
 
 	TimerType Type() const	{ return (TimerType) type; }
 
@@ -118,7 +118,7 @@ public:
 	static unsigned int* CurrentTimers()	{ return current_timers; }
 
 protected:
- 	TimerMgr(const Tag& arg_tag)
+	explicit TimerMgr(const Tag& arg_tag)
  		{
  		t = 0.0;
  		num_expired = 0;
@@ -141,19 +141,19 @@ protected:
 
 class PQ_TimerMgr : public TimerMgr {
 public:
-	PQ_TimerMgr(const Tag& arg_tag);
-	~PQ_TimerMgr();
+	explicit PQ_TimerMgr(const Tag& arg_tag);
+	~PQ_TimerMgr() override;
 
-	void Add(Timer* timer);
-	void Expire();
+	void Add(Timer* timer) override;
+	void Expire() override;
 
-	int Size() const	{ return q->Size(); }
-	int PeakSize() const	{ return q->PeakSize(); }
-	uint64 CumulativeNum() const	{ return q->CumulativeNum(); }
+	int Size() const override { return q->Size(); }
+	int PeakSize() const override { return q->PeakSize(); }
+	uint64 CumulativeNum() const override { return q->CumulativeNum(); }
 
 protected:
-	int DoAdvance(double t, int max_expire);
-	void Remove(Timer* timer);
+	int DoAdvance(double t, int max_expire) override;
+	void Remove(Timer* timer) override;
 
 	Timer* Remove()			{ return (Timer*) q->Remove(); }
 	Timer* Top()			{ return (Timer*) q->Top(); }
@@ -163,20 +163,20 @@ protected:
 
 class CQ_TimerMgr : public TimerMgr {
 public:
-	CQ_TimerMgr(const Tag& arg_tag);
-	~CQ_TimerMgr();
+	explicit CQ_TimerMgr(const Tag& arg_tag);
+	~CQ_TimerMgr() override;
 
-	void Add(Timer* timer);
-	void Expire();
+	void Add(Timer* timer) override;
+	void Expire() override;
 
-	int Size() const	{ return cq_size(cq); }
-	int PeakSize() const	{ return cq_max_size(cq); }
-	uint64 CumulativeNum() const	{ return cq_cumulative_num(cq); }
+	int Size() const override { return cq_size(cq); }
+	int PeakSize() const override { return cq_max_size(cq); }
+	uint64 CumulativeNum() const override { return cq_cumulative_num(cq); }
 	unsigned int MemoryUsage() const;
 
 protected:
-	int DoAdvance(double t, int max_expire);
-	void Remove(Timer* timer);
+	int DoAdvance(double t, int max_expire) override;
+	void Remove(Timer* timer) override;
 
 	struct cq_handle *cq;
 };
diff --git a/src/Trigger.h b/src/Trigger.h
index 3af9ddf1b0..0f7889d19a 100644
--- a/src/Trigger.h
+++ b/src/Trigger.h
@@ -21,7 +21,7 @@ public:
 	// right away.
 	Trigger(Expr* cond, Stmt* body, Stmt* timeout_stmts, Expr* timeout,
 		Frame* f, bool is_return, const Location* loc);
-	~Trigger();
+	~Trigger() override;
 
 	// Evaluates the condition. If true, executes the body and deletes
 	// the object deleted.
@@ -57,16 +57,16 @@ public:
 
 	bool Disabled() const { return disabled; }
 
-	virtual void Describe(ODesc* d) const { d->Add("<trigger>"); }
-
+	void Describe(ODesc* d) const override
+		{ d->Add("<trigger>"); }
 	// Overidden from Notifier.  We queue the trigger and evaluate it
 	// later to avoid race conditions.
-	virtual void Access(ID* id, const StateAccess& sa)
+	void Access(ID* id, const StateAccess& sa) override
 		{ QueueTrigger(this); }
-	virtual void Access(Val* val, const StateAccess& sa)
+	void Access(Val* val, const StateAccess& sa) override
 		{ QueueTrigger(this); }
 
-	virtual const char* Name() const;
+	const char* Name() const override;
 
 	static void QueueTrigger(Trigger* trigger);
 
diff --git a/src/Type.h b/src/Type.h
index ab52e10734..9366548902 100644
--- a/src/Type.h
+++ b/src/Type.h
@@ -82,8 +82,8 @@ const int MATCHES_INDEX_VECTOR = 2;
 
 class BroType : public BroObj {
 public:
-	BroType(TypeTag tag, bool base_type = false);
-	~BroType() { }
+	explicit BroType(TypeTag tag, bool base_type = false);
+	~BroType() override { }
 
 	BroType* Clone() const;
 
@@ -249,7 +249,7 @@ public:
 
 	BroType* Ref()		{ ::Ref(this); return this; }
 
-	virtual void Describe(ODesc* d) const override;
+	void Describe(ODesc* d) const override;
 	virtual void DescribeReST(ODesc* d, bool roles_only = false) const;
 
 	virtual unsigned MemoryAllocation() const;
@@ -265,7 +265,7 @@ public:
 	static std::set<BroType*> GetAliases(const std::string& type_name)
 		{ return BroType::type_aliases[type_name]; }
 
-	static void AddAlias(const std::string type_name, BroType* type)
+	static void AddAlias(const std::string &type_name, BroType* type)
 		{ BroType::type_aliases[type_name].insert(type); }
 
 protected:
@@ -287,13 +287,13 @@ private:
 
 class TypeList : public BroType {
 public:
-	TypeList(BroType* arg_pure_type = 0) : BroType(TYPE_LIST)
+	explicit TypeList(BroType* arg_pure_type = 0) : BroType(TYPE_LIST)
 		{
 		pure_type = arg_pure_type;
 		if ( pure_type )
 			pure_type->Ref();
 		}
-	~TypeList();
+	~TypeList() override;
 
 	const type_list* Types() const	{ return &types; }
 	type_list* Types()		{ return &types; }
@@ -352,7 +352,7 @@ protected:
 		indices = arg_indices;
 		yield_type = arg_yield_type;
 		}
-	~IndexType();
+	~IndexType() override;
 
 	DECLARE_SERIAL(IndexType)
 
@@ -379,7 +379,7 @@ protected:
 class SetType : public TableType {
 public:
 	SetType(TypeList* ind, ListExpr* arg_elements);
-	~SetType();
+	~SetType() override;
 
 	ListExpr* SetElements() const	{ return elements; }
 
@@ -395,7 +395,7 @@ class FuncType : public BroType {
 public:
 	FuncType(RecordType* args, BroType* yield, function_flavor f);
 
-	~FuncType();
+	~FuncType() override;
 
 	RecordType* Args() const	{ return args; }
 	BroType* YieldType() override;
@@ -428,8 +428,8 @@ protected:
 
 class TypeType : public BroType {
 public:
-	TypeType(BroType* t) : BroType(TYPE_TYPE)	{ type = t->Ref(); }
-	~TypeType()	{ Unref(type); }
+	explicit TypeType(BroType* t) : BroType(TYPE_TYPE)	{ type = t->Ref(); }
+	~TypeType() override { Unref(type); }
 
 	BroType* Type()	{ return type; }
 
@@ -460,9 +460,9 @@ public:
 
 class RecordType : public BroType {
 public:
-	RecordType(type_decl_list* types);
+	explicit RecordType(type_decl_list* types);
 
-	~RecordType();
+	~RecordType() override;
 
 	int HasField(const char* field) const override;
 	BroType* FieldType(const char* field) const override;
@@ -512,8 +512,8 @@ protected:
 
 class FileType : public BroType {
 public:
-	FileType(BroType* yield_type);
-	~FileType();
+	explicit FileType(BroType* yield_type);
+	~FileType() override;
 
 	BroType* YieldType() override;
 
@@ -529,8 +529,8 @@ protected:
 
 class OpaqueType : public BroType {
 public:
-	OpaqueType(const string& name);
-	virtual ~OpaqueType() { };
+	explicit OpaqueType(const string& name);
+	~OpaqueType() override { };
 
 	const string& Name() const { return name; }
 
@@ -549,9 +549,9 @@ class EnumType : public BroType {
 public:
 	typedef std::list<std::pair<string, bro_int_t> > enum_name_list;
 
-	EnumType(EnumType* e);
-	EnumType(const string& arg_name);
-	~EnumType();
+	explicit EnumType(EnumType* e);
+	explicit EnumType(const string& arg_name);
+	~EnumType() override;
 
 	// The value of this name is next internal counter value, starting
 	// with zero. The internal counter is incremented.
@@ -598,8 +598,8 @@ protected:
 
 class VectorType : public BroType {
 public:
-	VectorType(BroType* t);
-	virtual ~VectorType();
+	explicit VectorType(BroType* t);
+	~VectorType() override;
 	BroType* YieldType() override;
 	const BroType* YieldType() const;
 
diff --git a/src/UID.h b/src/UID.h
index 367b67d56d..642ecf4b48 100644
--- a/src/UID.h
+++ b/src/UID.h
@@ -28,7 +28,7 @@ public:
 	 * Construct a UID of a given bit-length, optionally from given values.
 	 * @see UID::Set
 	 */
-	UID(bro_uint_t bits, const uint64* v = 0, size_t n = 0)
+	explicit UID(bro_uint_t bits, const uint64* v = 0, size_t n = 0)
 		{ Set(bits, v, n); }
 
 	/**
diff --git a/src/Val.cc b/src/Val.cc
index 4db8aedd73..95bb8263a9 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -914,6 +914,11 @@ AddrVal::AddrVal(const char* text) : Val(TYPE_ADDR)
 	val.addr_val = new IPAddr(text);
 	}
 
+AddrVal::AddrVal(const std::string& text) : Val(TYPE_ADDR)
+	{
+	val.addr_val = new IPAddr(text);
+	}
+
 AddrVal::AddrVal(uint32 addr) : Val(TYPE_ADDR)
 	{
 	// ### perhaps do gethostbyaddr here?
diff --git a/src/Val.h b/src/Val.h
index 6da37b7137..ca04381176 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -131,11 +131,11 @@ public:
 #endif
 		}
 
-	Val(Func* f);
+	explicit Val(Func* f);
 
 	// Note, will unref 'f' when it's done, closing it unless
 	// class has ref'd it.
-	Val(BroFile* f);
+	explicit Val(BroFile* f);
 
 	Val(BroType* t, bool type_type) // Extra arg to differentiate from protected version.
 		{
@@ -154,7 +154,7 @@ public:
 #endif
 		}
 
-	virtual ~Val();
+	~Val() override;
 
 	Val* Ref()			{ ::Ref(this); return this; }
 	virtual Val* Clone() const;
@@ -365,7 +365,7 @@ protected:
 	virtual void ValDescribe(ODesc* d) const;
 	virtual void ValDescribeReST(ODesc* d) const;
 
-	Val(TypeTag t)
+	explicit Val(TypeTag t)
 		{
 		type = base_type(t);
 #ifdef DEBUG
@@ -373,7 +373,7 @@ protected:
 #endif
 		}
 
-	Val(BroType* t)
+	explicit Val(BroType* t)
 		{
 		type = t->Ref();
 #ifdef DEBUG
@@ -444,7 +444,7 @@ public:
 #endif
 		}
 
-	virtual uint64 LastModified() const override	{ return last_modified; }
+	uint64 LastModified() const override	{ return last_modified; }
 
 	// Mark value as changed.
 	void Modified()
@@ -453,10 +453,10 @@ public:
 		}
 
 protected:
-	MutableVal(BroType* t) : Val(t)
+	explicit MutableVal(BroType* t) : Val(t)
 		{ props = 0; id = 0; last_modified = SerialObj::ALWAYS; }
 	MutableVal()	{ props = 0; id = 0; last_modified = SerialObj::ALWAYS; }
-	~MutableVal();
+	~MutableVal() override;
 
 	friend class ID;
 	friend class Val;
@@ -532,7 +532,7 @@ public:
 
 	// Host-order port number already masked with port space protocol mask.
 	BRO_DEPRECATED("use port_mgr->Get() instead")
-	PortVal(uint32 p);
+	explicit PortVal(uint32 p);
 
 	Val* SizeVal() const override	{ return new Val(val.uint_val, TYPE_INT); }
 
@@ -569,36 +569,37 @@ protected:
 
 class AddrVal : public Val {
 public:
-	AddrVal(const char* text);
-	~AddrVal();
+	explicit AddrVal(const char* text);
+	explicit AddrVal(const std::string& text);
+	~AddrVal() override;
 
 	Val* SizeVal() const override;
 
 	// Constructor for address already in network order.
-	AddrVal(uint32 addr);          // IPv4.
-	AddrVal(const uint32 addr[4]); // IPv6.
-	AddrVal(const IPAddr& addr);
+	explicit AddrVal(uint32 addr);          // IPv4.
+	explicit AddrVal(const uint32 addr[4]); // IPv6.
+	explicit AddrVal(const IPAddr& addr);
 
 	unsigned int MemoryAllocation() const override;
 
 protected:
 	friend class Val;
 	AddrVal()	{}
-	AddrVal(TypeTag t) : Val(t)	{ }
-	AddrVal(BroType* t) : Val(t)	{ }
+	explicit AddrVal(TypeTag t) : Val(t)	{ }
+	explicit AddrVal(BroType* t) : Val(t)	{ }
 
 	DECLARE_SERIAL(AddrVal);
 };
 
 class SubNetVal : public Val {
 public:
-	SubNetVal(const char* text);
+	explicit SubNetVal(const char* text);
 	SubNetVal(const char* text, int width);
 	SubNetVal(uint32 addr, int width); // IPv4.
 	SubNetVal(const uint32 addr[4], int width); // IPv6.
 	SubNetVal(const IPAddr& addr, int width);
-	SubNetVal(const IPPrefix& prefix);
-	~SubNetVal();
+	explicit SubNetVal(const IPPrefix& prefix);
+	~SubNetVal() override;
 
 	Val* SizeVal() const override;
 
@@ -621,9 +622,9 @@ protected:
 
 class StringVal : public Val {
 public:
-	StringVal(BroString* s);
-	StringVal(const char* s);
-	StringVal(const string& s);
+	explicit StringVal(BroString* s);
+	explicit StringVal(const char* s);
+	explicit StringVal(const string& s);
 	StringVal(int length, const char* s);
 
 	Val* SizeVal() const override
@@ -653,8 +654,8 @@ protected:
 
 class PatternVal : public Val {
 public:
-	PatternVal(RE_Matcher* re);
-	~PatternVal();
+	explicit PatternVal(RE_Matcher* re);
+	~PatternVal() override;
 
 	int AddTo(Val* v, int is_first_init) const override;
 
@@ -675,8 +676,8 @@ protected:
 // element in their index.
 class ListVal : public Val {
 public:
-	ListVal(TypeTag t);
-	~ListVal();
+	explicit ListVal(TypeTag t);
+	~ListVal() override;
 
 	TypeTag BaseTag() const		{ return tag; }
 
@@ -722,7 +723,7 @@ extern double bro_start_network_time;
 
 class TableEntryVal {
 public:
-	TableEntryVal(Val* v)
+	explicit TableEntryVal(Val* v)
 		{
 		val = v;
 		last_access_time = network_time;
@@ -764,9 +765,9 @@ protected:
 class TableValTimer : public Timer {
 public:
 	TableValTimer(TableVal* val, double t);
-	~TableValTimer();
+	~TableValTimer() override;
 
-	virtual void Dispatch(double t, int is_expire);
+	void Dispatch(double t, int is_expire) override;
 
 	TableVal* Table()	{ return table; }
 
@@ -777,8 +778,8 @@ protected:
 class CompositeHash;
 class TableVal : public MutableVal {
 public:
-	TableVal(TableType* t, Attributes* attrs = 0);
-	~TableVal();
+	explicit TableVal(TableType* t, Attributes* attrs = 0);
+	~TableVal() override;
 
 	// Returns true if the assignment typechecked, false if not. The
 	// methods take ownership of new_val, but not of the index. Second
@@ -919,8 +920,8 @@ protected:
 
 class RecordVal : public MutableVal {
 public:
-	RecordVal(RecordType* t);
-	~RecordVal();
+	explicit RecordVal(RecordType* t);
+	~RecordVal() override;
 
 	Val* SizeVal() const override
 		{ return new Val(record_type->NumFields(), TYPE_COUNT); }
@@ -999,8 +1000,8 @@ protected:
 
 class VectorVal : public MutableVal {
 public:
-	VectorVal(VectorType* t);
-	~VectorVal();
+	explicit VectorVal(VectorType* t);
+	~VectorVal() override;
 
 	Val* SizeVal() const override
 		{ return new Val(uint32(val.vector_val->size()), TYPE_COUNT); }
@@ -1061,8 +1062,8 @@ protected:
 // functions). See OpaqueVal.h for derived classes.
 class OpaqueVal : public Val {
 public:
-	OpaqueVal(OpaqueType* t);
-	virtual ~OpaqueVal();
+	explicit OpaqueVal(OpaqueType* t);
+	~OpaqueVal() override;
 
 protected:
 	friend class Val;
diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h
index df77a990ce..a13df7e21e 100644
--- a/src/analyzer/Analyzer.h
+++ b/src/analyzer/Analyzer.h
@@ -102,7 +102,7 @@ public:
 	 *
 	 * @param conn The connection the analyzer is associated with.
 	 */
-	Analyzer(Connection* conn);
+	explicit Analyzer(Connection* conn);
 
 	/**
 	 * Destructor.
@@ -731,7 +731,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	virtual ~SupportAnalyzer() {}
+	~SupportAnalyzer() override {}
 
 	/**
 	 * Returns true if this is a support analyzer for the connection's
@@ -755,8 +755,8 @@ public:
 	*
 	* Parameters same as for Analyzer::ForwardPacket.
 	*/
-	virtual void ForwardPacket(int len, const u_char* data, bool orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
+	void ForwardPacket(int len, const u_char* data, bool orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
 
 	/**
 	* Passes stream input to the next sibling SupportAnalyzer if any, or
@@ -766,7 +766,7 @@ public:
 	*
 	* Parameters same as for Analyzer::ForwardStream.
 	*/
-	virtual void ForwardStream(int len, const u_char* data, bool orig);
+	void ForwardStream(int len, const u_char* data, bool orig) override;
 
 	/**
 	* Passes gap information to the next sibling SupportAnalyzer if any,
@@ -776,7 +776,7 @@ public:
 	*
 	* Parameters same as for Analyzer::ForwardPacket.
 	*/
-	virtual void ForwardUndelivered(uint64 seq, int len, bool orig);
+	void ForwardUndelivered(uint64 seq, int len, bool orig) override;
 
 protected:
 	friend class Analyzer;
@@ -814,7 +814,7 @@ public:
 	/**
 	 * Overridden from parent class.
 	 */
-	virtual void Done();
+	void Done() override;
 
 	/**
 	 * Returns true if the analyzer determines that in fact a new
diff --git a/src/analyzer/Component.h b/src/analyzer/Component.h
index cff79c2774..c52bf05fc6 100644
--- a/src/analyzer/Component.h
+++ b/src/analyzer/Component.h
@@ -61,7 +61,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	~Component();
+	~Component() override;
 
 	/**
 	 * Initialization function. This function has to be called before any
diff --git a/src/analyzer/Tag.h b/src/analyzer/Tag.h
index ad701a877f..926196c747 100644
--- a/src/analyzer/Tag.h
+++ b/src/analyzer/Tag.h
@@ -99,14 +99,14 @@ protected:
 	 * @param subtype The sub type, which is left to an analyzer for
 	 * interpretation. By default it's set to zero.
 	 */
-	Tag(type_t type, subtype_t subtype = 0);
+	explicit Tag(type_t type, subtype_t subtype = 0);
 
 	/**
 	 * Constructor.
 	 *
 	 * @param val An enum value of script type \c Analyzer::Tag.
 	 */
-	Tag(EnumVal* val) : ::Tag(val) {}
+	explicit Tag(EnumVal* val) : ::Tag(val) {}
 };
 
 }
diff --git a/src/analyzer/protocol/arp/ARP.h b/src/analyzer/protocol/arp/ARP.h
index 1bdd382714..86ea14d694 100644
--- a/src/analyzer/protocol/arp/ARP.h
+++ b/src/analyzer/protocol/arp/ARP.h
@@ -36,11 +36,11 @@ namespace analyzer { namespace arp {
 class ARP_Analyzer : public BroObj {
 public:
 	ARP_Analyzer();
-	virtual ~ARP_Analyzer();
+	~ARP_Analyzer() override;
 
 	void NextPacket(double t, const Packet* pkt);
 
-	void Describe(ODesc* d) const;
+	void Describe(ODesc* d) const override;
 	void RREvent(EventHandlerPtr e, const u_char* src, const u_char* dst,
 			const char* spa, const char* sha,
 			const char* tpa, const char* tha);
diff --git a/src/analyzer/protocol/ayiya/AYIYA.h b/src/analyzer/protocol/ayiya/AYIYA.h
index bffc7aabf8..4deb98c560 100644
--- a/src/analyzer/protocol/ayiya/AYIYA.h
+++ b/src/analyzer/protocol/ayiya/AYIYA.h
@@ -7,7 +7,7 @@ namespace analyzer { namespace ayiya {
 
 class AYIYA_Analyzer : public analyzer::Analyzer {
 public:
-	AYIYA_Analyzer(Connection* conn);
+	explicit AYIYA_Analyzer(Connection* conn);
 	virtual ~AYIYA_Analyzer();
 
 	virtual void Done();
diff --git a/src/analyzer/protocol/backdoor/BackDoor.h b/src/analyzer/protocol/backdoor/BackDoor.h
index 151eb51670..c954d176d5 100644
--- a/src/analyzer/protocol/backdoor/BackDoor.h
+++ b/src/analyzer/protocol/backdoor/BackDoor.h
@@ -12,7 +12,7 @@ namespace analyzer { namespace backdoor {
 
 class BackDoorEndpoint {
 public:
-	BackDoorEndpoint(tcp::TCP_Endpoint* e);
+	explicit BackDoorEndpoint(tcp::TCP_Endpoint* e);
 
 	int DataSent(double t, uint64 seq, int len, int caplen, const u_char* data,
 		     const IP_Hdr* ip, const struct tcphdr* tp);
@@ -66,11 +66,11 @@ protected:
 
 class BackDoor_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	BackDoor_Analyzer(Connection* c);
-	~BackDoor_Analyzer();
+	explicit BackDoor_Analyzer(Connection* c);
+	~BackDoor_Analyzer() override;
 
-	virtual void Init();
-	virtual void Done();
+	void Init() override;
+	void Done() override;
 	void StatTimer(double t, int is_expire);
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
@@ -79,9 +79,9 @@ public:
 protected:
 	// We support both packet and stream input, and can be instantiated
 	// even if the TCP analyzer is not yet reassembling.
-	virtual void DeliverPacket(int len, const u_char* data, bool is_orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
-	virtual void DeliverStream(int len, const u_char* data, bool is_orig);
+	void DeliverPacket(int len, const u_char* data, bool is_orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
+	void DeliverStream(int len, const u_char* data, bool is_orig) override;
 
 	void StatEvent();
 	void RemoveEvent();
@@ -99,9 +99,9 @@ protected:
 class BackDoorTimer : public Timer {
 public:
 	BackDoorTimer(double t, BackDoor_Analyzer* a);
-	~BackDoorTimer();
+	~BackDoorTimer() override;
 
-	void Dispatch(double t, int is_expire);
+	void Dispatch(double t, int is_expire) override;
 
 protected:
 	BackDoor_Analyzer* analyzer;
diff --git a/src/analyzer/protocol/bittorrent/BitTorrent.h b/src/analyzer/protocol/bittorrent/BitTorrent.h
index f1cd90c727..eb0cf6188a 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrent.h
+++ b/src/analyzer/protocol/bittorrent/BitTorrent.h
@@ -11,13 +11,13 @@ namespace analyzer { namespace bittorrent {
 
 class BitTorrent_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	BitTorrent_Analyzer(Connection* conn);
-	virtual ~BitTorrent_Analyzer();
+	explicit BitTorrent_Analyzer(Connection* conn);
+	~BitTorrent_Analyzer() override;
 
-	virtual void Done();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
-	virtual void EndpointEOF(bool is_orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
+	void EndpointEOF(bool is_orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new BitTorrent_Analyzer(conn); }
diff --git a/src/analyzer/protocol/bittorrent/BitTorrentTracker.h b/src/analyzer/protocol/bittorrent/BitTorrentTracker.h
index 532f7304fe..4f01d2a146 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrentTracker.h
+++ b/src/analyzer/protocol/bittorrent/BitTorrentTracker.h
@@ -44,13 +44,13 @@ enum btt_benc_states {
 
 class BitTorrentTracker_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	BitTorrentTracker_Analyzer(Connection* conn);
-	virtual ~BitTorrentTracker_Analyzer();
+	explicit BitTorrentTracker_Analyzer(Connection* conn);
+	~BitTorrentTracker_Analyzer() override;
 
-	virtual void Done();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
-	virtual void EndpointEOF(bool is_orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
+	void EndpointEOF(bool is_orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new BitTorrentTracker_Analyzer(conn); }
@@ -59,7 +59,7 @@ protected:
 	void ClientRequest(int len, const u_char* data);
 	void ServerReply(int len, const u_char* data);
 
-	void InitBencParser(void);
+	void InitBencParser();
 
 	void DeliverWeird(const char* msg, bool orig);
 
@@ -67,19 +67,19 @@ protected:
 	void RequestGet(char* uri);
 	void RequestHeader(char* name, char* value)
 		{ ParseHeader(name, value, true); }
-	void EmitRequest(void);
+	void EmitRequest();
 
 	bool ParseResponse(char* line);
 	void ResponseStatus(char* status);
 	void ResponseHeader(char* name, char* value)
 		{ ParseHeader(name, value, false); }
-	void ResponseBody(void);
+	void ResponseBody();
 	void ResponseBenc(int name_len, char* name, enum btt_benc_types type,
 				int value_len, char* value);
 	void ResponseBenc(int name_len, char* name, enum btt_benc_types type,
 				bro_int_t value);
-	int ResponseParseBenc(void);
-	void EmitResponse(void);
+	int ResponseParseBenc();
+	void EmitResponse();
 
 	void ParseHeader(char* name, char* value, bool is_request);
 
diff --git a/src/analyzer/protocol/conn-size/ConnSize.h b/src/analyzer/protocol/conn-size/ConnSize.h
index d8dff57a1b..b272f8539c 100644
--- a/src/analyzer/protocol/conn-size/ConnSize.h
+++ b/src/analyzer/protocol/conn-size/ConnSize.h
@@ -11,15 +11,15 @@ namespace analyzer { namespace conn_size {
 
 class ConnSize_Analyzer : public analyzer::Analyzer {
 public:
-	ConnSize_Analyzer(Connection* c);
-	virtual ~ConnSize_Analyzer();
+	explicit ConnSize_Analyzer(Connection* c);
+	~ConnSize_Analyzer() override;
 
-	virtual void Init();
-	virtual void Done();
+	void Init() override;
+	void Done() override;
 
 	// from Analyzer.h
-	virtual void UpdateConnVal(RecordVal *conn_val);
-	virtual void FlipRoles();
+	void UpdateConnVal(RecordVal *conn_val) override;
+	void FlipRoles() override;
 
 	void SetThreshold(uint64_t threshold, bool bytes, bool orig);
 	uint64 GetThreshold(bool bytes, bool orig);
@@ -28,8 +28,8 @@ public:
 		{ return new ConnSize_Analyzer(conn); }
 
 protected:
-	virtual void DeliverPacket(int len, const u_char* data, bool is_orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
+	void DeliverPacket(int len, const u_char* data, bool is_orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
 	void CheckSizes(bool is_orig);
 
 	void ThresholdEvent(EventHandlerPtr f, uint64 threshold, bool is_orig);
diff --git a/src/analyzer/protocol/dce-rpc/DCE_RPC.h b/src/analyzer/protocol/dce-rpc/DCE_RPC.h
index 498e055e0a..c3e7aa54a3 100644
--- a/src/analyzer/protocol/dce-rpc/DCE_RPC.h
+++ b/src/analyzer/protocol/dce-rpc/DCE_RPC.h
@@ -14,8 +14,8 @@ namespace analyzer { namespace dce_rpc {
 
 class DCE_RPC_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	DCE_RPC_Analyzer(Connection* conn);
-	~DCE_RPC_Analyzer();
+	explicit DCE_RPC_Analyzer(Connection* conn);
+	~DCE_RPC_Analyzer() override;
 
 	void Done() override;
 	void DeliverStream(int len, const u_char* data, bool orig) override;
diff --git a/src/analyzer/protocol/dhcp/DHCP.h b/src/analyzer/protocol/dhcp/DHCP.h
index f8f0449878..95510ddf97 100644
--- a/src/analyzer/protocol/dhcp/DHCP.h
+++ b/src/analyzer/protocol/dhcp/DHCP.h
@@ -9,12 +9,12 @@ namespace analyzer { namespace dhcp {
 
 class DHCP_Analyzer : public analyzer::Analyzer {
 public:
-	DHCP_Analyzer(Connection* conn);
-	virtual ~DHCP_Analyzer();
+	explicit DHCP_Analyzer(Connection* conn);
+	~DHCP_Analyzer() override;
 
-	virtual void Done();
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
+	void Done() override;
+	void DeliverPacket(int len, const u_char* data, bool orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new DHCP_Analyzer(conn); }
diff --git a/src/analyzer/protocol/dnp3/DNP3.h b/src/analyzer/protocol/dnp3/DNP3.h
index aa4ef78479..4eaec3a214 100644
--- a/src/analyzer/protocol/dnp3/DNP3.h
+++ b/src/analyzer/protocol/dnp3/DNP3.h
@@ -11,7 +11,7 @@ namespace analyzer { namespace dnp3 {
 
 class DNP3_Base {
 public:
-	DNP3_Base(analyzer::Analyzer* analyzer);
+	explicit DNP3_Base(analyzer::Analyzer* analyzer);
 	virtual ~DNP3_Base();
 
 	binpac::DNP3::DNP3_Conn* Interpreter()	{ return interp; }
@@ -64,13 +64,13 @@ protected:
 
 class DNP3_TCP_Analyzer : public DNP3_Base, public tcp::TCP_ApplicationAnalyzer {
 public:
-	DNP3_TCP_Analyzer(Connection* conn);
-	virtual ~DNP3_TCP_Analyzer();
+	explicit DNP3_TCP_Analyzer(Connection* conn);
+	~DNP3_TCP_Analyzer() override;
 
-	virtual void Done();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
-	virtual void EndpointEOF(bool is_orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
+	void EndpointEOF(bool is_orig) override;
 
 	static Analyzer* Instantiate(Connection* conn)
 		{ return new DNP3_TCP_Analyzer(conn); }
@@ -78,11 +78,11 @@ public:
 
 class DNP3_UDP_Analyzer : public DNP3_Base, public analyzer::Analyzer {
 public:
-	DNP3_UDP_Analyzer(Connection* conn);
-	virtual ~DNP3_UDP_Analyzer();
+	explicit DNP3_UDP_Analyzer(Connection* conn);
+	~DNP3_UDP_Analyzer() override;
 
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-                    uint64 seq, const IP_Hdr* ip, int caplen);
+	void DeliverPacket(int len, const u_char* data, bool orig,
+                    uint64 seq, const IP_Hdr* ip, int caplen) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new DNP3_UDP_Analyzer(conn); }
diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc
index 1fc94a80ba..145d19950f 100644
--- a/src/analyzer/protocol/dns/DNS.cc
+++ b/src/analyzer/protocol/dns/DNS.cc
@@ -182,7 +182,7 @@ int DNS_Interpreter::ParseQuestion(DNS_MsgInfo* msg,
 		return 0;
 		}
 
-	EventHandlerPtr dns_event = 0;
+	EventHandlerPtr dns_event = nullptr;
 
 	if ( msg->QR == 0 )
 		dns_event = dns_request;
diff --git a/src/analyzer/protocol/dns/DNS.h b/src/analyzer/protocol/dns/DNS.h
index 87618cd18e..58a263637e 100644
--- a/src/analyzer/protocol/dns/DNS.h
+++ b/src/analyzer/protocol/dns/DNS.h
@@ -151,7 +151,7 @@ public:
 
 class DNS_Interpreter {
 public:
-	DNS_Interpreter(analyzer::Analyzer* analyzer);
+	explicit DNS_Interpreter(analyzer::Analyzer* analyzer);
 
 	int ParseMessage(const u_char* data, int len, int is_query);
 
@@ -239,14 +239,14 @@ typedef enum {
 class Contents_DNS : public tcp::TCP_SupportAnalyzer {
 public:
 	Contents_DNS(Connection* c, bool orig, DNS_Interpreter* interp);
-	~Contents_DNS();
+	~Contents_DNS() override;
 
 	void Flush();		///< process any partially-received data
 
 	TCP_DNS_state State() const	{ return state; }
 
 protected:
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
+	void DeliverStream(int len, const u_char* data, bool orig) override;
 
 	DNS_Interpreter* interp;
 
@@ -260,16 +260,16 @@ protected:
 // Works for both TCP and UDP.
 class DNS_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	DNS_Analyzer(Connection* conn);
-	~DNS_Analyzer();
+	explicit DNS_Analyzer(Connection* conn);
+	~DNS_Analyzer() override;
 
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
+	void DeliverPacket(int len, const u_char* data, bool orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
 
-	virtual void Init();
-	virtual void Done();
-	virtual void ConnectionClosed(tcp::TCP_Endpoint* endpoint,
-					tcp::TCP_Endpoint* peer, int gen_event);
+	void Init() override;
+	void Done() override;
+	void ConnectionClosed(tcp::TCP_Endpoint* endpoint,
+					tcp::TCP_Endpoint* peer, int gen_event) override;
 
 	void ExpireTimer(double t);
 
diff --git a/src/analyzer/protocol/file/File.h b/src/analyzer/protocol/file/File.h
index 8e611fe0c3..58073afa6e 100644
--- a/src/analyzer/protocol/file/File.h
+++ b/src/analyzer/protocol/file/File.h
@@ -13,11 +13,11 @@ class File_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
 	File_Analyzer(const char* name, Connection* conn);
 
-	virtual void Done();
+	void Done() override;
 
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
+	void DeliverStream(int len, const u_char* data, bool orig) override;
 
-	void Undelivered(uint64 seq, int len, bool orig);
+	void Undelivered(uint64 seq, int len, bool orig) override;
 
 //	static analyzer::Analyzer* Instantiate(Connection* conn)
 //		{ return new File_Analyzer(conn); }
@@ -34,7 +34,7 @@ protected:
 
 class IRC_Data : public File_Analyzer {
 public:
-	IRC_Data(Connection* conn)
+	explicit IRC_Data(Connection* conn)
 		: File_Analyzer("IRC_Data", conn)
 		{ }
 
@@ -44,7 +44,7 @@ public:
 
 class FTP_Data : public File_Analyzer {
 public:
-	FTP_Data(Connection* conn)
+	explicit FTP_Data(Connection* conn)
 		: File_Analyzer("FTP_Data", conn)
 		{ }
 
diff --git a/src/analyzer/protocol/finger/Finger.h b/src/analyzer/protocol/finger/Finger.h
index c677f4c599..d7ea81f430 100644
--- a/src/analyzer/protocol/finger/Finger.h
+++ b/src/analyzer/protocol/finger/Finger.h
@@ -10,12 +10,12 @@ namespace analyzer { namespace finger {
 
 class Finger_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	Finger_Analyzer(Connection* conn);
-	virtual ~Finger_Analyzer()	{}
+	explicit Finger_Analyzer(Connection* conn);
+	~Finger_Analyzer() override {}
 
-	virtual void Done();
+	void Done() override;
 	// Line-based input.
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
+	void DeliverStream(int len, const u_char* data, bool orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new Finger_Analyzer(conn); }
diff --git a/src/analyzer/protocol/ftp/FTP.h b/src/analyzer/protocol/ftp/FTP.h
index f829547f36..668e2da83e 100644
--- a/src/analyzer/protocol/ftp/FTP.h
+++ b/src/analyzer/protocol/ftp/FTP.h
@@ -10,10 +10,10 @@ namespace analyzer { namespace ftp {
 
 class FTP_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	FTP_Analyzer(Connection* conn);
+	explicit FTP_Analyzer(Connection* conn);
 
-	virtual void Done();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{
@@ -40,7 +40,7 @@ public:
 	    : SupportAnalyzer("FTP_ADAT", conn, arg_orig),
 	      first_token(true) { }
 
-	void DeliverStream(int len, const u_char* data, bool orig);
+	void DeliverStream(int len, const u_char* data, bool orig) override;
 
 protected:
 	// Used by the client-side analyzer to tell if it needs to peek at the
diff --git a/src/analyzer/protocol/gnutella/Gnutella.h b/src/analyzer/protocol/gnutella/Gnutella.h
index c2b161ec04..895116cfbb 100644
--- a/src/analyzer/protocol/gnutella/Gnutella.h
+++ b/src/analyzer/protocol/gnutella/Gnutella.h
@@ -36,11 +36,11 @@ public:
 
 class Gnutella_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	Gnutella_Analyzer(Connection* conn);
-	~Gnutella_Analyzer();
+	explicit Gnutella_Analyzer(Connection* conn);
+	~Gnutella_Analyzer() override;
 
-	virtual void Done ();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
+	void Done () override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new Gnutella_Analyzer(conn); }
diff --git a/src/analyzer/protocol/gssapi/GSSAPI.h b/src/analyzer/protocol/gssapi/GSSAPI.h
index 2fd01a3ab5..e99eab2abd 100644
--- a/src/analyzer/protocol/gssapi/GSSAPI.h
+++ b/src/analyzer/protocol/gssapi/GSSAPI.h
@@ -15,8 +15,8 @@ class GSSAPI_Analyzer
 : public tcp::TCP_ApplicationAnalyzer {
 
 public:
-	GSSAPI_Analyzer(Connection* conn);
-	virtual ~GSSAPI_Analyzer();
+	explicit GSSAPI_Analyzer(Connection* conn);
+	~GSSAPI_Analyzer() override;
 
 	// Overriden from Analyzer.
 	void Done() override;
diff --git a/src/analyzer/protocol/gtpv1/GTPv1.h b/src/analyzer/protocol/gtpv1/GTPv1.h
index 45cacaa17a..d7487a2881 100644
--- a/src/analyzer/protocol/gtpv1/GTPv1.h
+++ b/src/analyzer/protocol/gtpv1/GTPv1.h
@@ -7,7 +7,7 @@ namespace analyzer { namespace gtpv1 {
 
 class GTPv1_Analyzer : public analyzer::Analyzer {
 public:
-	GTPv1_Analyzer(Connection* conn);
+	explicit GTPv1_Analyzer(Connection* conn);
 	virtual ~GTPv1_Analyzer();
 
 	virtual void Done();
diff --git a/src/analyzer/protocol/http/HTTP.h b/src/analyzer/protocol/http/HTTP.h
index 31bc485f35..a9b781a269 100644
--- a/src/analyzer/protocol/http/HTTP.h
+++ b/src/analyzer/protocol/http/HTTP.h
@@ -34,7 +34,7 @@ class HTTP_Entity : public mime::MIME_Entity {
 public:
 	HTTP_Entity(HTTP_Message* msg, MIME_Entity* parent_entity,
 			int expect_body);
-	~HTTP_Entity()
+	~HTTP_Entity() override
 		{
 		if ( zip )
 			{ zip->Done(); delete zip; }
@@ -104,7 +104,7 @@ friend class HTTP_Entity;
 public:
 	HTTP_Message(HTTP_Analyzer* analyzer, tcp::ContentLine_Analyzer* cl,
 			 bool is_orig, int expect_body, int64_t init_header_length);
-	~HTTP_Message();
+	~HTTP_Message() override;
 	void Done(const int interrupted, const char* msg);
 	void Done() override { Done(0, "message ends normally"); }
 
@@ -153,7 +153,7 @@ protected:
 class HTTP_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
 	HTTP_Analyzer(Connection* conn);
-	~HTTP_Analyzer();
+	~HTTP_Analyzer() override;
 
 	void HTTP_Header(int is_orig, mime::MIME_Header* h);
 	void HTTP_EntityData(int is_orig, BroString* entity_data);
diff --git a/src/analyzer/protocol/icmp/ICMP.h b/src/analyzer/protocol/icmp/ICMP.h
index 391ab4d7a7..4fee289d5b 100644
--- a/src/analyzer/protocol/icmp/ICMP.h
+++ b/src/analyzer/protocol/icmp/ICMP.h
@@ -17,19 +17,19 @@ typedef enum {
 // RuleMatcherState to perform our own matching.
 class ICMP_Analyzer : public analyzer::TransportLayerAnalyzer {
 public:
-	ICMP_Analyzer(Connection* conn);
+	explicit ICMP_Analyzer(Connection* conn);
 
-	virtual void UpdateConnVal(RecordVal *conn_val);
+	void UpdateConnVal(RecordVal *conn_val) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new ICMP_Analyzer(conn); }
 
 protected:
-	virtual void Done();
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
-	virtual bool IsReuse(double t, const u_char* pkt);
-	virtual unsigned int MemoryAllocation() const;
+	void Done() override;
+	void DeliverPacket(int len, const u_char* data, bool orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
+	bool IsReuse(double t, const u_char* pkt) override;
+	unsigned int MemoryAllocation() const override;
 
 	void ICMP_Sent(const struct icmp* icmpp, int len, int caplen, int icmpv6,
 	               const u_char* data, const IP_Hdr* ip_hdr);
diff --git a/src/analyzer/protocol/ident/Ident.h b/src/analyzer/protocol/ident/Ident.h
index 07fe8c116f..daaef3fb38 100644
--- a/src/analyzer/protocol/ident/Ident.h
+++ b/src/analyzer/protocol/ident/Ident.h
@@ -10,10 +10,10 @@ namespace analyzer { namespace ident {
 
 class Ident_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	Ident_Analyzer(Connection* conn);
-	virtual void Done();
+	explicit Ident_Analyzer(Connection* conn);
+	void Done() override;
 
-	virtual void DeliverStream(int length, const u_char* data, bool is_orig);
+	void DeliverStream(int length, const u_char* data, bool is_orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new Ident_Analyzer(conn); }
diff --git a/src/analyzer/protocol/imap/IMAP.h b/src/analyzer/protocol/imap/IMAP.h
index e71770d360..631660d452 100644
--- a/src/analyzer/protocol/imap/IMAP.h
+++ b/src/analyzer/protocol/imap/IMAP.h
@@ -13,15 +13,15 @@ namespace analyzer { namespace imap {
 
 class IMAP_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	IMAP_Analyzer(Connection* conn);
-	virtual ~IMAP_Analyzer();
+	explicit IMAP_Analyzer(Connection* conn);
+	~IMAP_Analyzer() override;
 
-	virtual void Done();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
 
 	// Overriden from tcp::TCP_ApplicationAnalyzer.
-	virtual void EndpointEOF(bool is_orig);
+	void EndpointEOF(bool is_orig) override;
 
 	void StartTLS();
 
diff --git a/src/analyzer/protocol/interconn/InterConn.h b/src/analyzer/protocol/interconn/InterConn.h
index 6ab7f138b2..04d5a2b5c6 100644
--- a/src/analyzer/protocol/interconn/InterConn.h
+++ b/src/analyzer/protocol/interconn/InterConn.h
@@ -11,7 +11,7 @@ namespace analyzer { namespace interconn {
 
 class InterConnEndpoint : public BroObj {
 public:
-	InterConnEndpoint(tcp::TCP_Endpoint* e);
+	explicit InterConnEndpoint(tcp::TCP_Endpoint* e);
 
 	int DataSent(double t, uint64 seq, int len, int caplen, const u_char* data,
 		     const IP_Hdr* ip, const struct tcphdr* tp);
@@ -42,11 +42,11 @@ protected:
 
 class InterConn_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	InterConn_Analyzer(Connection* c);
-	~InterConn_Analyzer();
+	explicit InterConn_Analyzer(Connection* c);
+	~InterConn_Analyzer() override;
 
-	virtual void Init();
-	virtual void Done();
+	void Init() override;
+	void Done() override;
 	void StatTimer(double t, int is_expire);
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
@@ -55,9 +55,9 @@ public:
 protected:
 	// We support both packet and stream input and can be put in place even
 	// if the TCP analyzer is not yet reassembling.
-	virtual void DeliverPacket(int len, const u_char* data, bool is_orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
-	virtual void DeliverStream(int len, const u_char* data, bool is_orig);
+	void DeliverPacket(int len, const u_char* data, bool is_orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
+	void DeliverStream(int len, const u_char* data, bool is_orig) override;
 
 	void StatEvent();
 	void RemoveEvent();
@@ -75,9 +75,9 @@ protected:
 class InterConnTimer : public Timer {
 public:
 	InterConnTimer(double t, InterConn_Analyzer* a);
-	~InterConnTimer();
+	~InterConnTimer() override;
 
-	void Dispatch(double t, int is_expire);
+	void Dispatch(double t, int is_expire) override;
 
 protected:
 	InterConn_Analyzer* analyzer;
diff --git a/src/analyzer/protocol/irc/IRC.h b/src/analyzer/protocol/irc/IRC.h
index 497225846d..8981d2ee65 100644
--- a/src/analyzer/protocol/irc/IRC.h
+++ b/src/analyzer/protocol/irc/IRC.h
@@ -17,7 +17,7 @@ public:
 	/**
 	* \brief Constructor, builds a new analyzer object.
 	*/
-	IRC_Analyzer(Connection* conn);
+	explicit IRC_Analyzer(Connection* conn);
 
 	/**
 	* \brief Called when connection is closed.
diff --git a/src/analyzer/protocol/krb/KRB.h b/src/analyzer/protocol/krb/KRB.h
index 392df5c13d..99e0529ff1 100644
--- a/src/analyzer/protocol/krb/KRB.h
+++ b/src/analyzer/protocol/krb/KRB.h
@@ -10,7 +10,7 @@ namespace analyzer { namespace krb {
 class KRB_Analyzer : public analyzer::Analyzer {
 
 public:
-	KRB_Analyzer(Connection* conn);
+	explicit KRB_Analyzer(Connection* conn);
 	virtual ~KRB_Analyzer();
 
 	virtual void Done();
diff --git a/src/analyzer/protocol/krb/KRB_TCP.h b/src/analyzer/protocol/krb/KRB_TCP.h
index 0dcf99ca97..0ce4d5f65d 100644
--- a/src/analyzer/protocol/krb/KRB_TCP.h
+++ b/src/analyzer/protocol/krb/KRB_TCP.h
@@ -12,15 +12,15 @@ namespace analyzer { namespace krb_tcp {
 class KRB_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 
 public:
-	KRB_Analyzer(Connection* conn);
-	virtual ~KRB_Analyzer();
+	explicit KRB_Analyzer(Connection* conn);
+	~KRB_Analyzer() override;
 
-	virtual void Done();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
 
 	// Overriden from tcp::TCP_ApplicationAnalyzer.
-	virtual void EndpointEOF(bool is_orig);
+	void EndpointEOF(bool is_orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new KRB_Analyzer(conn); }
diff --git a/src/analyzer/protocol/login/Login.h b/src/analyzer/protocol/login/Login.h
index 25d1b24005..a17b636685 100644
--- a/src/analyzer/protocol/login/Login.h
+++ b/src/analyzer/protocol/login/Login.h
@@ -24,16 +24,16 @@ typedef enum {
 class Login_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
 	Login_Analyzer(const char* name, Connection* conn);
-	~Login_Analyzer();
+	~Login_Analyzer() override;
 
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
+	void DeliverStream(int len, const u_char* data, bool orig) override;
 
-	virtual void SetEnv(bool orig, char* name, char* val);
+	void SetEnv(bool orig, char* name, char* val) override;
 
 	login_state LoginState() const		{ return state; }
 	void SetLoginState(login_state s)	{ state = s; }
 
-	virtual void EndpointEOF(bool is_orig);
+	void EndpointEOF(bool is_orig) override;
 
 protected:
 	void NewLine(bool orig, char* line);
diff --git a/src/analyzer/protocol/login/NVT.h b/src/analyzer/protocol/login/NVT.h
index 3bcadcdc8e..c967962953 100644
--- a/src/analyzer/protocol/login/NVT.h
+++ b/src/analyzer/protocol/login/NVT.h
@@ -61,19 +61,19 @@ protected:
 
 class TelnetTerminalOption : public TelnetOption {
 public:
-	TelnetTerminalOption(NVT_Analyzer* arg_endp)
+	explicit TelnetTerminalOption(NVT_Analyzer* arg_endp)
 		: TelnetOption(arg_endp, TELNET_OPTION_TERMINAL)	{ }
 
-	void RecvSubOption(u_char* data, int len);
+	void RecvSubOption(u_char* data, int len) override;
 };
 
 class TelnetEncryptOption : public TelnetOption {
 public:
-	TelnetEncryptOption(NVT_Analyzer* arg_endp)
+	explicit TelnetEncryptOption(NVT_Analyzer* arg_endp)
 		: TelnetOption(arg_endp, TELNET_OPTION_ENCRYPT)
 			{ did_encrypt_request = doing_encryption = 0; }
 
-	void RecvSubOption(u_char* data, int len);
+	void RecvSubOption(u_char* data, int len) override;
 
 	int DidRequest() const		{ return did_encrypt_request; }
 	int DoingEncryption() const	{ return doing_encryption; }
@@ -85,11 +85,11 @@ protected:
 
 class TelnetAuthenticateOption : public TelnetOption {
 public:
-	TelnetAuthenticateOption(NVT_Analyzer* arg_endp)
+	explicit TelnetAuthenticateOption(NVT_Analyzer* arg_endp)
 		: TelnetOption(arg_endp, TELNET_OPTION_AUTHENTICATE)
 			{ authentication_requested = 0; }
 
-	void RecvSubOption(u_char* data, int len);
+	void RecvSubOption(u_char* data, int len) override;
 
 	int DidRequestAuthentication() const
 		{ return authentication_requested; }
@@ -101,11 +101,11 @@ protected:
 
 class TelnetEnvironmentOption : public TelnetOption {
 public:
-	TelnetEnvironmentOption(NVT_Analyzer* arg_endp)
+	explicit TelnetEnvironmentOption(NVT_Analyzer* arg_endp)
 		: TelnetOption(arg_endp, TELNET_OPTION_ENVIRON)
 			{ }
 
-	void RecvSubOption(u_char* data, int len);
+	void RecvSubOption(u_char* data, int len) override;
 
 protected:
 	char* ExtractEnv(u_char*& data, int& len, int& code);
@@ -113,20 +113,20 @@ protected:
 
 class TelnetBinaryOption : public TelnetOption {
 public:
-	TelnetBinaryOption(NVT_Analyzer* arg_endp)
+	explicit TelnetBinaryOption(NVT_Analyzer* arg_endp)
 		: TelnetOption(arg_endp, TELNET_OPTION_BINARY)
 			{ }
 
-	void SetActive(int is_active);
+	void SetActive(int is_active) override;
 
 protected:
-	void InconsistentOption(unsigned int type);
+	void InconsistentOption(unsigned int type) override;
 };
 
 class NVT_Analyzer : public tcp::ContentLine_Analyzer {
 public:
 	NVT_Analyzer(Connection* conn, bool orig);
-	~NVT_Analyzer();
+	~NVT_Analyzer() override;
 
 	TelnetOption* FindOption(unsigned int code);
 	TelnetOption* FindPeerOption(unsigned int code);
@@ -146,7 +146,7 @@ public:
 		{ return authentication_has_been_accepted; }
 
 protected:
-	void DoDeliver(int len, const u_char* data);
+	void DoDeliver(int len, const u_char* data) override;
 
 	void ScanOption(int seq, int len, const u_char* data);
 	virtual void SawOption(unsigned int code);
diff --git a/src/analyzer/protocol/login/RSH.h b/src/analyzer/protocol/login/RSH.h
index 3f6e9851f1..44a9609a53 100644
--- a/src/analyzer/protocol/login/RSH.h
+++ b/src/analyzer/protocol/login/RSH.h
@@ -26,12 +26,12 @@ class Rsh_Analyzer;
 class Contents_Rsh_Analyzer : public tcp::ContentLine_Analyzer {
 public:
 	Contents_Rsh_Analyzer(Connection* conn, bool orig, Rsh_Analyzer* analyzer);
-	~Contents_Rsh_Analyzer();
+	~Contents_Rsh_Analyzer() override;
 
 	rsh_state RshSaveState() const	{ return save_state; }
 
 protected:
-	virtual void DoDeliver(int len, const u_char* data);
+	void DoDeliver(int len, const u_char* data) override;
 	void BadProlog();
 
 	rsh_state state, save_state;
@@ -42,9 +42,9 @@ protected:
 
 class Rsh_Analyzer : public Login_Analyzer {
 public:
-	Rsh_Analyzer(Connection* conn);
+	explicit Rsh_Analyzer(Connection* conn);
 
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
+	void DeliverStream(int len, const u_char* data, bool orig) override;
 
 	void ClientUserName(const char* s);
 	void ServerUserName(const char* s);
diff --git a/src/analyzer/protocol/login/Rlogin.h b/src/analyzer/protocol/login/Rlogin.h
index 0e8a7eb93b..ffce6214ea 100644
--- a/src/analyzer/protocol/login/Rlogin.h
+++ b/src/analyzer/protocol/login/Rlogin.h
@@ -35,7 +35,7 @@ class Contents_Rlogin_Analyzer : public tcp::ContentLine_Analyzer {
 public:
 	Contents_Rlogin_Analyzer(Connection* conn, bool orig,
 					Rlogin_Analyzer* analyzer);
-	~Contents_Rlogin_Analyzer();
+	~Contents_Rlogin_Analyzer() override;
 
 	void SetPeer(Contents_Rlogin_Analyzer* arg_peer)
 		{ peer = arg_peer; }
@@ -44,7 +44,7 @@ public:
 		{ return state; }
 
 protected:
-	void DoDeliver(int len, const u_char* data);
+	void DoDeliver(int len, const u_char* data) override;
 	void BadProlog();
 
 	rlogin_state state, save_state;
@@ -56,7 +56,7 @@ protected:
 
 class Rlogin_Analyzer : public Login_Analyzer {
 public:
-	Rlogin_Analyzer(Connection* conn);
+	explicit Rlogin_Analyzer(Connection* conn);
 
 	void ClientUserName(const char* s);
 	void ServerUserName(const char* s);
diff --git a/src/analyzer/protocol/login/Telnet.h b/src/analyzer/protocol/login/Telnet.h
index 936d7a8427..3bafff8e78 100644
--- a/src/analyzer/protocol/login/Telnet.h
+++ b/src/analyzer/protocol/login/Telnet.h
@@ -9,8 +9,8 @@ namespace analyzer { namespace login {
 
 class Telnet_Analyzer : public Login_Analyzer {
 public:
-	Telnet_Analyzer(Connection* conn);
-	virtual ~Telnet_Analyzer()	{}
+	explicit Telnet_Analyzer(Connection* conn);
+	~Telnet_Analyzer() override {}
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new Telnet_Analyzer(conn); }
diff --git a/src/analyzer/protocol/mime/MIME.h b/src/analyzer/protocol/mime/MIME.h
index fcc921993d..2ee58f24d1 100644
--- a/src/analyzer/protocol/mime/MIME.h
+++ b/src/analyzer/protocol/mime/MIME.h
@@ -65,7 +65,7 @@ protected:
 
 class MIME_Header {
 public:
-	MIME_Header(MIME_Multiline* hl);
+	explicit MIME_Header(MIME_Multiline* hl);
 	~MIME_Header();
 
 	data_chunk_t get_name() const	{ return name; }
@@ -181,7 +181,7 @@ protected:
 
 class MIME_Message {
 public:
-	MIME_Message(analyzer::Analyzer* arg_analyzer)
+	explicit MIME_Message(analyzer::Analyzer* arg_analyzer)
 		{
 		// Cannot initialize top_level entity because we do
 		// not know its type yet (MIME_Entity / MIME_Mail /
@@ -231,7 +231,7 @@ protected:
 class MIME_Mail : public MIME_Message {
 public:
 	MIME_Mail(analyzer::Analyzer* mail_conn, bool is_orig, int buf_size = 0);
-	~MIME_Mail();
+	~MIME_Mail() override;
 	void Done() override;
 
 	void BeginEntity(MIME_Entity* entity) override;
diff --git a/src/analyzer/protocol/modbus/Modbus.h b/src/analyzer/protocol/modbus/Modbus.h
index b60331fea9..c871e37610 100644
--- a/src/analyzer/protocol/modbus/Modbus.h
+++ b/src/analyzer/protocol/modbus/Modbus.h
@@ -8,14 +8,14 @@ namespace analyzer { namespace modbus {
 
 class ModbusTCP_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	ModbusTCP_Analyzer(Connection* conn);
-	virtual ~ModbusTCP_Analyzer();
+	explicit ModbusTCP_Analyzer(Connection* conn);
+	~ModbusTCP_Analyzer() override;
 
-	virtual void Done();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
 
-	virtual void Undelivered(uint64 seq, int len, bool orig);
-	virtual void EndpointEOF(bool is_orig);
+	void Undelivered(uint64 seq, int len, bool orig) override;
+	void EndpointEOF(bool is_orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new ModbusTCP_Analyzer(conn); }
diff --git a/src/analyzer/protocol/mysql/MySQL.h b/src/analyzer/protocol/mysql/MySQL.h
index 5512a80941..a82acdb6d1 100644
--- a/src/analyzer/protocol/mysql/MySQL.h
+++ b/src/analyzer/protocol/mysql/MySQL.h
@@ -15,17 +15,17 @@ class MySQL_Analyzer
 : public tcp::TCP_ApplicationAnalyzer {
 
 public:
-	MySQL_Analyzer(Connection* conn);
-	virtual ~MySQL_Analyzer();
+	explicit MySQL_Analyzer(Connection* conn);
+	~MySQL_Analyzer() override;
 
 	// Overriden from Analyzer.
-	virtual void Done();
+	void Done() override;
 
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
 
 	// Overriden from tcp::TCP_ApplicationAnalyzer.
-	virtual void EndpointEOF(bool is_orig);
+	void EndpointEOF(bool is_orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new MySQL_Analyzer(conn); }
diff --git a/src/analyzer/protocol/ncp/NCP.h b/src/analyzer/protocol/ncp/NCP.h
index 11a7d6c6e2..713eca756d 100644
--- a/src/analyzer/protocol/ncp/NCP.h
+++ b/src/analyzer/protocol/ncp/NCP.h
@@ -31,7 +31,7 @@ namespace analyzer { namespace ncp {
 
 class NCP_Session {
 public:
-	NCP_Session(analyzer::Analyzer* analyzer);
+	explicit NCP_Session(analyzer::Analyzer* analyzer);
 	virtual ~NCP_Session() {}
 
 	virtual void Deliver(int is_orig, int len, const u_char* data);
@@ -51,7 +51,7 @@ protected:
 
 class FrameBuffer {
 public:
-	FrameBuffer(int header_length);
+	explicit FrameBuffer(int header_length);
 	virtual ~FrameBuffer();
 
 	// Returns true if a frame is ready
@@ -80,17 +80,17 @@ public:
 	NCP_FrameBuffer() : FrameBuffer(NCP_TCPIP_HEADER_LENGTH) {}
 
 protected:
-	void compute_msg_length();
+	void compute_msg_length() override;
 };
 
 class Contents_NCP_Analyzer : public tcp::TCP_SupportAnalyzer {
 public:
 	Contents_NCP_Analyzer(Connection* conn, bool orig, NCP_Session* session);
-	~Contents_NCP_Analyzer();
+	~Contents_NCP_Analyzer() override;
 
 protected:
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
 
 	NCP_FrameBuffer buffer;
 	NCP_Session* session;
@@ -101,8 +101,8 @@ protected:
 
 class NCP_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	NCP_Analyzer(Connection* conn);
-	virtual ~NCP_Analyzer();
+	explicit NCP_Analyzer(Connection* conn);
+	~NCP_Analyzer() override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new NCP_Analyzer(conn); }
diff --git a/src/analyzer/protocol/netbios/NetbiosSSN.h b/src/analyzer/protocol/netbios/NetbiosSSN.h
index 1d7ad284e0..cfc15fceb1 100644
--- a/src/analyzer/protocol/netbios/NetbiosSSN.h
+++ b/src/analyzer/protocol/netbios/NetbiosSSN.h
@@ -64,7 +64,7 @@ struct NetbiosDGM_RawMsgHdr {
 
 class NetbiosSSN_Interpreter {
 public:
-	NetbiosSSN_Interpreter(Analyzer* analyzer);
+	explicit NetbiosSSN_Interpreter(Analyzer* analyzer);
 
 	int ParseMessage(unsigned int type, unsigned int flags,
 			const u_char* data, int len, int is_query);
@@ -117,7 +117,7 @@ class Contents_NetbiosSSN : public tcp::TCP_SupportAnalyzer {
 public:
 	Contents_NetbiosSSN(Connection* conn, bool orig,
 				NetbiosSSN_Interpreter* interp);
-	~Contents_NetbiosSSN();
+	~Contents_NetbiosSSN() override;
 
 	void Flush();	// process any partially-received data
 
@@ -141,8 +141,8 @@ protected:
 
 class NetbiosSSN_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	NetbiosSSN_Analyzer(Connection* conn);
-	~NetbiosSSN_Analyzer();
+	explicit NetbiosSSN_Analyzer(Connection* conn);
+	~NetbiosSSN_Analyzer() override;
 
 	void Done() override;
 	void DeliverPacket(int len, const u_char* data, bool orig,
diff --git a/src/analyzer/protocol/ntlm/NTLM.h b/src/analyzer/protocol/ntlm/NTLM.h
index 41117ac176..e8be2c809a 100644
--- a/src/analyzer/protocol/ntlm/NTLM.h
+++ b/src/analyzer/protocol/ntlm/NTLM.h
@@ -15,8 +15,8 @@ class NTLM_Analyzer
 : public tcp::TCP_ApplicationAnalyzer {
 
 public:
-	NTLM_Analyzer(Connection* conn);
-	virtual ~NTLM_Analyzer();
+	explicit NTLM_Analyzer(Connection* conn);
+	~NTLM_Analyzer() override;
 
 	// Overriden from Analyzer.
 	void Done() override;
diff --git a/src/analyzer/protocol/ntp/NTP.h b/src/analyzer/protocol/ntp/NTP.h
index 7987f3086d..5b5d3d7baa 100644
--- a/src/analyzer/protocol/ntp/NTP.h
+++ b/src/analyzer/protocol/ntp/NTP.h
@@ -38,15 +38,15 @@ struct ntpdata {
 
 class NTP_Analyzer : public analyzer::Analyzer {
 public:
-	NTP_Analyzer(Connection* conn);
+	explicit NTP_Analyzer(Connection* conn);
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new NTP_Analyzer(conn); }
 
 protected:
-	virtual void Done();
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
+	void Done() override;
+	void DeliverPacket(int len, const u_char* data, bool orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
 
 	int Request(const u_char* data, int len);
 	int Reply(const u_char* data, int len);
diff --git a/src/analyzer/protocol/pia/PIA.h b/src/analyzer/protocol/pia/PIA.h
index 85683289a9..924b405987 100644
--- a/src/analyzer/protocol/pia/PIA.h
+++ b/src/analyzer/protocol/pia/PIA.h
@@ -19,7 +19,7 @@ namespace analyzer { namespace pia {
 // PIAs and then each needs its own matching-state.
 class PIA : public RuleMatcherState {
 public:
-	PIA(analyzer::Analyzer* as_analyzer);
+	explicit PIA(analyzer::Analyzer* as_analyzer);
 	virtual ~PIA();
 
 	// Called when PIA wants to put an Analyzer in charge.  rule is the
@@ -90,43 +90,43 @@ private:
 // PIA for UDP.
 class PIA_UDP : public PIA, public analyzer::Analyzer {
 public:
-	PIA_UDP(Connection* conn)
+	explicit PIA_UDP(Connection* conn)
 	: PIA(this), Analyzer("PIA_UDP", conn)
 		{ SetConn(conn); }
-	virtual ~PIA_UDP()	{ }
+	~PIA_UDP() override { }
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new PIA_UDP(conn); }
 
 protected:
-	virtual void Done()
+	void Done() override
 		{
 		Analyzer::Done();
 		PIA_Done();
 		}
 
-	virtual void DeliverPacket(int len, const u_char* data, bool is_orig,
-					uint64 seq, const IP_Hdr* ip, int caplen)
+	void DeliverPacket(int len, const u_char* data, bool is_orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override
 		{
 		Analyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen);
 		PIA_DeliverPacket(len, data, is_orig, seq, ip, caplen, true);
 		}
 
-	virtual void ActivateAnalyzer(analyzer::Tag tag, const Rule* rule);
-	virtual void DeactivateAnalyzer(analyzer::Tag tag);
+	void ActivateAnalyzer(analyzer::Tag tag, const Rule* rule) override;
+	void DeactivateAnalyzer(analyzer::Tag tag) override;
 };
 
 // PIA for TCP.  Accepts both packet and stream input (and reassembles
 // packets before passing payload on to children).
 class PIA_TCP : public PIA, public tcp::TCP_ApplicationAnalyzer {
 public:
-	PIA_TCP(Connection* conn)
+	explicit PIA_TCP(Connection* conn)
 		: PIA(this), tcp::TCP_ApplicationAnalyzer("PIA_TCP", conn)
 		{ stream_mode = false; SetConn(conn); }
 
-	virtual ~PIA_TCP();
+	~PIA_TCP() override;
 
-	virtual void Init();
+	void Init() override;
 
 	// The first packet for each direction of a connection is passed
 	// in here.
@@ -144,25 +144,25 @@ public:
 		{ return new PIA_TCP(conn); }
 
 protected:
-	virtual void Done()
+	void Done() override
 		{
 		Analyzer::Done();
 		PIA_Done();
 		}
 
-	virtual void DeliverPacket(int len, const u_char* data, bool is_orig,
-					uint64 seq, const IP_Hdr* ip, int caplen)
+	void DeliverPacket(int len, const u_char* data, bool is_orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override
 		{
 		Analyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen);
 		PIA_DeliverPacket(len, data, is_orig, seq, ip, caplen, false);
 		}
 
-	virtual void DeliverStream(int len, const u_char* data, bool is_orig);
-	virtual void Undelivered(uint64 seq, int len, bool is_orig);
+	void DeliverStream(int len, const u_char* data, bool is_orig) override;
+	void Undelivered(uint64 seq, int len, bool is_orig) override;
 
-	virtual void ActivateAnalyzer(analyzer::Tag tag,
-					const Rule* rule = 0);
-	virtual void DeactivateAnalyzer(analyzer::Tag tag);
+	void ActivateAnalyzer(analyzer::Tag tag,
+					const Rule* rule = 0) override;
+	void DeactivateAnalyzer(analyzer::Tag tag) override;
 
 private:
 	// FIXME: Not sure yet whether we need both pkt_buffer and stream_buffer.
diff --git a/src/analyzer/protocol/pop3/POP3.h b/src/analyzer/protocol/pop3/POP3.h
index 7b4b592810..9bc48a08f3 100644
--- a/src/analyzer/protocol/pop3/POP3.h
+++ b/src/analyzer/protocol/pop3/POP3.h
@@ -64,11 +64,11 @@ typedef enum {
 
 class POP3_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	POP3_Analyzer(Connection* conn);
-	~POP3_Analyzer();
+	explicit POP3_Analyzer(Connection* conn);
+	~POP3_Analyzer() override;
 
-	virtual void Done();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{
diff --git a/src/analyzer/protocol/radius/RADIUS.h b/src/analyzer/protocol/radius/RADIUS.h
index e91b13bbcb..b7dae6fbdd 100644
--- a/src/analyzer/protocol/radius/RADIUS.h
+++ b/src/analyzer/protocol/radius/RADIUS.h
@@ -14,13 +14,13 @@ namespace analyzer { namespace RADIUS {
 
 class RADIUS_Analyzer : public analyzer::Analyzer {
 public:
-	RADIUS_Analyzer(Connection* conn);
-	virtual ~RADIUS_Analyzer();
+	explicit RADIUS_Analyzer(Connection* conn);
+	~RADIUS_Analyzer() override;
 
 	// Overriden from Analyzer.
-	virtual void Done();
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
+	void Done() override;
+	void DeliverPacket(int len, const u_char* data, bool orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new RADIUS_Analyzer(conn); }
diff --git a/src/analyzer/protocol/rdp/RDP.h b/src/analyzer/protocol/rdp/RDP.h
index 9d4eda1db8..bc97e5999d 100644
--- a/src/analyzer/protocol/rdp/RDP.h
+++ b/src/analyzer/protocol/rdp/RDP.h
@@ -14,15 +14,14 @@ namespace analyzer { namespace rdp {
 class RDP_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 
 public:
-	RDP_Analyzer(Connection* conn);
-	virtual ~RDP_Analyzer();
+	explicit RDP_Analyzer(Connection* conn);
+	~RDP_Analyzer() override;
 
 	// Overriden from Analyzer.
-	virtual void Done();
-	
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
-	virtual void EndpointEOF(bool is_orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
+	void EndpointEOF(bool is_orig) override;
 
 	static analyzer::Analyzer* InstantiateAnalyzer(Connection* conn)
 		{ return new RDP_Analyzer(conn); }
diff --git a/src/analyzer/protocol/rfb/RFB.h b/src/analyzer/protocol/rfb/RFB.h
index 88a17eea5a..3b440e7740 100644
--- a/src/analyzer/protocol/rfb/RFB.h
+++ b/src/analyzer/protocol/rfb/RFB.h
@@ -15,17 +15,17 @@ class RFB_Analyzer
 : public tcp::TCP_ApplicationAnalyzer {
 
 public:
-	RFB_Analyzer(Connection* conn);
-	virtual ~RFB_Analyzer();
+	explicit RFB_Analyzer(Connection* conn);
+	~RFB_Analyzer() override;
 
 	// Overriden from Analyzer.
-	virtual void Done();
+	void Done() override;
 
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
 
 	// Overriden from tcp::TCP_ApplicationAnalyzer.
-	virtual void EndpointEOF(bool is_orig);
+	void EndpointEOF(bool is_orig) override;
 
 
 	static analyzer::Analyzer* InstantiateAnalyzer(Connection* conn)
diff --git a/src/analyzer/protocol/rpc/MOUNT.h b/src/analyzer/protocol/rpc/MOUNT.h
index ed0c8fc9fc..42da4f61ed 100644
--- a/src/analyzer/protocol/rpc/MOUNT.h
+++ b/src/analyzer/protocol/rpc/MOUNT.h
@@ -11,13 +11,13 @@ namespace analyzer { namespace rpc {
 
 class MOUNT_Interp : public RPC_Interpreter {
 public:
-	MOUNT_Interp(analyzer::Analyzer* arg_analyzer) : RPC_Interpreter(arg_analyzer) { }
+	explicit MOUNT_Interp(analyzer::Analyzer* arg_analyzer) : RPC_Interpreter(arg_analyzer) { }
 
 protected:
-	int RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n);
+	int RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n) override;
 	int RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status,
 				const u_char*& buf, int& n, double start_time,
-				double last_time, int reply_len);
+				double last_time, int reply_len) override;
 
 	// Returns a new val_list that already has a conn_val, rpc_status and
 	// mount_status. These are the first parameters for each mount_* event
@@ -42,8 +42,8 @@ protected:
 
 class MOUNT_Analyzer : public RPC_Analyzer {
 public:
-	MOUNT_Analyzer(Connection* conn);
-	virtual void Init();
+	explicit MOUNT_Analyzer(Connection* conn);
+	void Init() override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new MOUNT_Analyzer(conn); }
diff --git a/src/analyzer/protocol/rpc/NFS.h b/src/analyzer/protocol/rpc/NFS.h
index dd336d7dee..2ec4047946 100644
--- a/src/analyzer/protocol/rpc/NFS.h
+++ b/src/analyzer/protocol/rpc/NFS.h
@@ -11,13 +11,13 @@ namespace analyzer { namespace rpc {
 
 class NFS_Interp : public RPC_Interpreter {
 public:
-	NFS_Interp(analyzer::Analyzer* arg_analyzer) : RPC_Interpreter(arg_analyzer) { }
+	explicit NFS_Interp(analyzer::Analyzer* arg_analyzer) : RPC_Interpreter(arg_analyzer) { }
 
 protected:
-	int RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n);
+	int RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n) override;
 	int RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status,
 				const u_char*& buf, int& n, double start_time,
-				double last_time, int reply_len);
+				double last_time, int reply_len) override;
 
 	// Returns a new val_list that already has a conn_val, rpc_status and
 	// nfs_status. These are the first parameters for each nfs_* event
@@ -83,8 +83,8 @@ protected:
 
 class NFS_Analyzer : public RPC_Analyzer {
 public:
-	NFS_Analyzer(Connection* conn);
-	virtual void Init();
+	explicit NFS_Analyzer(Connection* conn);
+	void Init() override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new NFS_Analyzer(conn); }
diff --git a/src/analyzer/protocol/rpc/Portmap.h b/src/analyzer/protocol/rpc/Portmap.h
index 3704bd8383..06eed3157d 100644
--- a/src/analyzer/protocol/rpc/Portmap.h
+++ b/src/analyzer/protocol/rpc/Portmap.h
@@ -9,13 +9,13 @@ namespace analyzer { namespace rpc {
 
 class PortmapperInterp : public RPC_Interpreter {
 public:
-	PortmapperInterp(analyzer::Analyzer* arg_analyzer) : RPC_Interpreter(arg_analyzer) { }
+	explicit PortmapperInterp(analyzer::Analyzer* arg_analyzer) : RPC_Interpreter(arg_analyzer) { }
 
 protected:
-	int RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n);
+	int RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n) override;
 	int RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status success,
 			   const u_char*& buf, int& n, double start_time,
-			   double last_time, int reply_len);
+			   double last_time, int reply_len) override;
 	uint32 CheckPort(uint32 port);
 
 	void Event(EventHandlerPtr f, Val* request, BifEnum::rpc_status status, Val* reply);
@@ -27,9 +27,9 @@ protected:
 
 class Portmapper_Analyzer : public RPC_Analyzer {
 public:
-	Portmapper_Analyzer(Connection* conn);
-	virtual ~Portmapper_Analyzer();
-	virtual void Init();
+	explicit Portmapper_Analyzer(Connection* conn);
+	~Portmapper_Analyzer() override;
+	void Init() override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new Portmapper_Analyzer(conn); }
diff --git a/src/analyzer/protocol/rpc/RPC.h b/src/analyzer/protocol/rpc/RPC.h
index ab7b3968c7..8fa19b8d53 100644
--- a/src/analyzer/protocol/rpc/RPC.h
+++ b/src/analyzer/protocol/rpc/RPC.h
@@ -103,7 +103,7 @@ declare(PDict,RPC_CallInfo);
 
 class RPC_Interpreter {
 public:
-	RPC_Interpreter(analyzer::Analyzer* analyzer);
+	explicit RPC_Interpreter(analyzer::Analyzer* analyzer);
 	virtual ~RPC_Interpreter();
 
 	// Delivers the given RPC.  Returns true if "len" bytes were
@@ -190,7 +190,7 @@ protected:
 class Contents_RPC : public tcp::TCP_SupportAnalyzer {
 public:
 	Contents_RPC(Connection* conn, bool orig, RPC_Interpreter* interp);
-	virtual ~Contents_RPC();
+	~Contents_RPC() override;
 
 protected:
 	typedef enum {
@@ -209,10 +209,10 @@ protected:
 		RESYNC_INIT,
 	} resync_state_t;
 
-	virtual void Init();
+	void Init() override;
 	virtual bool CheckResync(int& len, const u_char*& data, bool orig);
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
 
 	virtual void NeedResync() {
 		resync_state = NEED_RESYNC;
@@ -237,13 +237,13 @@ class RPC_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
 	RPC_Analyzer(const char* name, Connection* conn,
 			RPC_Interpreter* arg_interp);
-	virtual ~RPC_Analyzer();
+	~RPC_Analyzer() override;
 
-	virtual void Done();
+	void Done() override;
 
 protected:
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
+	void DeliverPacket(int len, const u_char* data, bool orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
 
 	void ExpireTimer(double t);
 
diff --git a/src/analyzer/protocol/sip/SIP.h b/src/analyzer/protocol/sip/SIP.h
index 130e70f46a..4e4496f2cb 100644
--- a/src/analyzer/protocol/sip/SIP.h
+++ b/src/analyzer/protocol/sip/SIP.h
@@ -10,14 +10,14 @@ namespace analyzer { namespace SIP {
 
 class SIP_Analyzer : public analyzer::Analyzer {
 public:
-	SIP_Analyzer(Connection* conn);
-	virtual ~SIP_Analyzer();
+	explicit SIP_Analyzer(Connection* conn);
+	~SIP_Analyzer() override;
 
 	// Overridden from Analyzer
 
-	virtual void Done();
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-				   	   uint64 seq, const IP_Hdr* ip, int caplen);
+	void Done() override;
+	void DeliverPacket(int len, const u_char* data, bool orig,
+				   	   uint64 seq, const IP_Hdr* ip, int caplen) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 	{ return new SIP_Analyzer(conn); }
diff --git a/src/analyzer/protocol/sip/SIP_TCP.h b/src/analyzer/protocol/sip/SIP_TCP.h
index f2a4dad479..b96e1db069 100644
--- a/src/analyzer/protocol/sip/SIP_TCP.h
+++ b/src/analyzer/protocol/sip/SIP_TCP.h
@@ -14,15 +14,15 @@ namespace analyzer { namespace sip_tcp {
 
 class SIP_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	SIP_Analyzer(Connection* conn);
-	virtual ~SIP_Analyzer();
+	explicit SIP_Analyzer(Connection* conn);
+	~SIP_Analyzer() override;
 
-	virtual void Done();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
 
 	// Overriden from tcp::TCP_ApplicationAnalyzer.
-	virtual void EndpointEOF(bool is_orig);
+	void EndpointEOF(bool is_orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new SIP_Analyzer(conn); }
diff --git a/src/analyzer/protocol/smb/SMB.h b/src/analyzer/protocol/smb/SMB.h
index ea9ec2e6a5..37aaa071a5 100644
--- a/src/analyzer/protocol/smb/SMB.h
+++ b/src/analyzer/protocol/smb/SMB.h
@@ -8,8 +8,8 @@ namespace analyzer { namespace smb {
 
 class SMB_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	SMB_Analyzer(Connection* conn);
-	virtual ~SMB_Analyzer();
+	explicit SMB_Analyzer(Connection* conn);
+	~SMB_Analyzer() override;
 
 	void Done() override;
 	void DeliverStream(int len, const u_char* data, bool orig) override;
diff --git a/src/analyzer/protocol/smtp/SMTP.h b/src/analyzer/protocol/smtp/SMTP.h
index b4396f28f7..846e21e57e 100644
--- a/src/analyzer/protocol/smtp/SMTP.h
+++ b/src/analyzer/protocol/smtp/SMTP.h
@@ -39,13 +39,13 @@ typedef enum {
 
 class SMTP_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	SMTP_Analyzer(Connection* conn);
-	~SMTP_Analyzer();
+	explicit SMTP_Analyzer(Connection* conn);
+	~SMTP_Analyzer() override;
 
-	virtual void Done();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void ConnectionFinished(int half_finished);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void ConnectionFinished(int half_finished) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
 
 	void SkipData()	{ skip_data = 1; }	// skip delivery of data lines
 
diff --git a/src/analyzer/protocol/snmp/SNMP.h b/src/analyzer/protocol/snmp/SNMP.h
index d01704d2ae..3d709d362a 100644
--- a/src/analyzer/protocol/snmp/SNMP.h
+++ b/src/analyzer/protocol/snmp/SNMP.h
@@ -11,7 +11,7 @@ class SNMP_Analyzer : public analyzer::Analyzer {
 
 public:
 
-	SNMP_Analyzer(Connection* conn);
+	explicit SNMP_Analyzer(Connection* conn);
 	virtual ~SNMP_Analyzer();
 
 	virtual void Done();
diff --git a/src/analyzer/protocol/socks/SOCKS.h b/src/analyzer/protocol/socks/SOCKS.h
index 841f2ee2ab..eaec5c7ee2 100644
--- a/src/analyzer/protocol/socks/SOCKS.h
+++ b/src/analyzer/protocol/socks/SOCKS.h
@@ -16,15 +16,15 @@ namespace analyzer { namespace socks {
 
 class SOCKS_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	SOCKS_Analyzer(Connection* conn);
-	~SOCKS_Analyzer();
+	explicit SOCKS_Analyzer(Connection* conn);
+	~SOCKS_Analyzer() override;
 
 	void EndpointDone(bool orig);
 
-	virtual void Done();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
-	virtual void EndpointEOF(bool is_orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
+	void EndpointEOF(bool is_orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new SOCKS_Analyzer(conn); }
diff --git a/src/analyzer/protocol/ssh/SSH.h b/src/analyzer/protocol/ssh/SSH.h
index dc3a7c5e39..36a8919722 100644
--- a/src/analyzer/protocol/ssh/SSH.h
+++ b/src/analyzer/protocol/ssh/SSH.h
@@ -13,16 +13,16 @@ namespace analyzer {
 		class SSH_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 
 		public:
-			SSH_Analyzer(Connection* conn);
-			virtual ~SSH_Analyzer();
+			explicit SSH_Analyzer(Connection* conn);
+			~SSH_Analyzer() override;
 
 			// Overriden from Analyzer.
-			virtual void Done();
-			virtual void DeliverStream(int len, const u_char* data, bool orig);
-			virtual void Undelivered(uint64 seq, int len, bool orig);
+			void Done() override;
+			void DeliverStream(int len, const u_char* data, bool orig) override;
+			void Undelivered(uint64 seq, int len, bool orig) override;
 
 			// Overriden from tcp::TCP_ApplicationAnalyzer.
-			virtual void EndpointEOF(bool is_orig);
+			void EndpointEOF(bool is_orig) override;
 
 			static analyzer::Analyzer* Instantiate(Connection* conn)
 				{ return new SSH_Analyzer(conn); }
diff --git a/src/analyzer/protocol/ssl/DTLS.h b/src/analyzer/protocol/ssl/DTLS.h
index 6611a6974e..fc862707fd 100644
--- a/src/analyzer/protocol/ssl/DTLS.h
+++ b/src/analyzer/protocol/ssl/DTLS.h
@@ -13,14 +13,14 @@ namespace analyzer { namespace dtls {
 
 class DTLS_Analyzer : public analyzer::Analyzer {
 public:
-	DTLS_Analyzer(Connection* conn);
-	virtual ~DTLS_Analyzer();
+	explicit DTLS_Analyzer(Connection* conn);
+	~DTLS_Analyzer() override;
 
 	// Overriden from Analyzer.
-	virtual void Done();
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
-	virtual void EndOfData(bool is_orig);
+	void Done() override;
+	void DeliverPacket(int len, const u_char* data, bool orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
+	void EndOfData(bool is_orig) override;
 
 	void SendHandshake(uint8 msg_type, uint32 length, const u_char* begin, const u_char* end, bool orig);
 
diff --git a/src/analyzer/protocol/ssl/SSL.h b/src/analyzer/protocol/ssl/SSL.h
index 4d3bceaec1..4119d72a91 100644
--- a/src/analyzer/protocol/ssl/SSL.h
+++ b/src/analyzer/protocol/ssl/SSL.h
@@ -13,13 +13,13 @@ namespace analyzer { namespace ssl {
 
 class SSL_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	SSL_Analyzer(Connection* conn);
-	virtual ~SSL_Analyzer();
+	explicit SSL_Analyzer(Connection* conn);
+	~SSL_Analyzer() override;
 
 	// Overriden from Analyzer.
-	virtual void Done();
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
+	void Done() override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
 
 	void SendHandshake(const u_char* begin, const u_char* end, bool orig);
 
@@ -27,7 +27,7 @@ public:
 	void StartEncryption();
 
 	// Overriden from tcp::TCP_ApplicationAnalyzer.
-	virtual void EndpointEOF(bool is_orig);
+	void EndpointEOF(bool is_orig) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new SSL_Analyzer(conn); }
diff --git a/src/analyzer/protocol/stepping-stone/SteppingStone.h b/src/analyzer/protocol/stepping-stone/SteppingStone.h
index c0b06d79e7..b9ebd1ff8b 100644
--- a/src/analyzer/protocol/stepping-stone/SteppingStone.h
+++ b/src/analyzer/protocol/stepping-stone/SteppingStone.h
@@ -19,7 +19,7 @@ declare(PDict,SteppingStoneEndpoint);
 class SteppingStoneEndpoint : public BroObj {
 public:
 	SteppingStoneEndpoint(tcp::TCP_Endpoint* e, SteppingStoneManager* m);
-	~SteppingStoneEndpoint();
+	~SteppingStoneEndpoint() override;
 	void Done();
 
 	int DataSent(double t, uint64 seq, int len, int caplen, const u_char* data,
@@ -47,11 +47,11 @@ protected:
 
 class SteppingStone_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	SteppingStone_Analyzer(Connection* c);
-	virtual ~SteppingStone_Analyzer() {};
+	explicit SteppingStone_Analyzer(Connection* c);
+	~SteppingStone_Analyzer() override {};
 
-	virtual void Init();
-	virtual void Done();
+	void Init() override;
+	void Done() override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new SteppingStone_Analyzer(conn); }
@@ -59,9 +59,9 @@ public:
 protected:
 	// We support both packet and stream input and can be put in place even
 	// if the TCP analyzer is not yet reassebmling.
-	virtual void DeliverPacket(int len, const u_char* data, bool is_orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
-	virtual void DeliverStream(int len, const u_char* data, bool is_orig);
+	void DeliverPacket(int len, const u_char* data, bool is_orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
+	void DeliverStream(int len, const u_char* data, bool is_orig) override;
 
 	int orig_stream_pos;
 	int resp_stream_pos;
diff --git a/src/analyzer/protocol/syslog/Syslog.h b/src/analyzer/protocol/syslog/Syslog.h
index 8f2580806c..8701277497 100644
--- a/src/analyzer/protocol/syslog/Syslog.h
+++ b/src/analyzer/protocol/syslog/Syslog.h
@@ -11,12 +11,12 @@ namespace analyzer { namespace syslog {
 
 class Syslog_Analyzer : public analyzer::Analyzer {
 public:
-	Syslog_Analyzer(Connection* conn);
-	virtual ~Syslog_Analyzer();
+	explicit Syslog_Analyzer(Connection* conn);
+	~Syslog_Analyzer() override;
 
-	virtual void Done();
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
+	void Done() override;
+	void DeliverPacket(int len, const u_char* data, bool orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new Syslog_Analyzer(conn); }
diff --git a/src/analyzer/protocol/tcp/ContentLine.h b/src/analyzer/protocol/tcp/ContentLine.h
index 5cb6d2f3d4..f225db8029 100644
--- a/src/analyzer/protocol/tcp/ContentLine.h
+++ b/src/analyzer/protocol/tcp/ContentLine.h
@@ -16,7 +16,7 @@ namespace analyzer { namespace tcp {
 class ContentLine_Analyzer : public TCP_SupportAnalyzer {
 public:
 	ContentLine_Analyzer(Connection* conn, bool orig, int max_line_length=DEFAULT_MAX_LINE_LENGTH);
-	~ContentLine_Analyzer();
+	~ContentLine_Analyzer() override;
 
 	void SupressWeirds(bool enable)
 		{ suppress_weirds = enable; }
@@ -65,9 +65,9 @@ public:
 protected:
 	ContentLine_Analyzer(const char* name, Connection* conn, bool orig, int max_line_length=DEFAULT_MAX_LINE_LENGTH);
 
-	virtual void DeliverStream(int len, const u_char* data, bool is_orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
-	virtual void EndpointEOF(bool is_orig);
+	void DeliverStream(int len, const u_char* data, bool is_orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
+	void EndpointEOF(bool is_orig) override;
 
 	class State;
 	void InitState();
diff --git a/src/analyzer/protocol/tcp/TCP.h b/src/analyzer/protocol/tcp/TCP.h
index e5589b01a3..db3c2efa91 100644
--- a/src/analyzer/protocol/tcp/TCP.h
+++ b/src/analyzer/protocol/tcp/TCP.h
@@ -26,8 +26,8 @@ class TCP_Reassembler;
 
 class TCP_Analyzer : public analyzer::TransportLayerAnalyzer {
 public:
-	TCP_Analyzer(Connection* conn);
-	virtual ~TCP_Analyzer();
+	explicit TCP_Analyzer(Connection* conn);
+	~TCP_Analyzer() override;
 
 	void EnableReassembly();
 
@@ -35,8 +35,8 @@ public:
 	// independently of whether we do any reassembly.
 	void AddChildPacketAnalyzer(analyzer::Analyzer* a);
 
-	virtual Analyzer* FindChild(ID id);
-	virtual Analyzer* FindChild(Tag tag);
+	Analyzer* FindChild(ID id) override;
+	Analyzer* FindChild(Tag tag) override;
 
 	// True if the connection has closed in some sense, false otherwise.
 	int IsClosed() const	{ return orig->did_close || resp->did_close; }
@@ -62,8 +62,8 @@ public:
 	// the test is whether it has any outstanding, un-acked data.
 	int DataPending(TCP_Endpoint* closing_endp);
 
-	virtual void SetContentsFile(unsigned int direction, BroFile* f);
-	virtual BroFile* GetContentsFile(unsigned int direction) const;
+	void SetContentsFile(unsigned int direction, BroFile* f) override;
+	BroFile* GetContentsFile(unsigned int direction) const override;
 
 	// Callback to process a TCP option.
 	typedef int (*proc_tcp_option_t)(unsigned int opt, unsigned int optlen,
@@ -71,7 +71,7 @@ public:
 			bool is_orig, void* cookie);
 
 	// From Analyzer.h
-	virtual void UpdateConnVal(RecordVal *conn_val);
+	void UpdateConnVal(RecordVal *conn_val) override;
 
 	// Needs to be static because it's passed as a pointer-to-function
 	// rather than pointer-to-member-function.
@@ -88,13 +88,13 @@ protected:
 	friend class analyzer::pia::PIA_TCP;
 
 	// Analyzer interface.
-	virtual void Init();
-	virtual void Done();
-	virtual void DeliverPacket(int len, const u_char* data, bool orig, uint64 seq, const IP_Hdr* ip, int caplen);
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
-	virtual void Undelivered(uint64 seq, int len, bool orig);
-	virtual void FlipRoles();
-	virtual bool IsReuse(double t, const u_char* pkt);
+	void Init() override;
+	void Done() override;
+	void DeliverPacket(int len, const u_char* data, bool orig, uint64 seq, const IP_Hdr* ip, int caplen) override;
+	void DeliverStream(int len, const u_char* data, bool orig) override;
+	void Undelivered(uint64 seq, int len, bool orig) override;
+	void FlipRoles() override;
+	bool IsReuse(double t, const u_char* pkt) override;
 
 	// Returns the TCP header pointed to by data (which we assume is
 	// aligned), updating data, len & caplen.  Returns nil if the header
@@ -205,11 +205,11 @@ public:
 	: Analyzer(name, conn)
 		{ tcp = 0; }
 
-	TCP_ApplicationAnalyzer(Connection* conn)
+	explicit TCP_ApplicationAnalyzer(Connection* conn)
 	: Analyzer(conn)
 		{ tcp = 0; }
 
-	virtual ~TCP_ApplicationAnalyzer()	{ }
+	~TCP_ApplicationAnalyzer() override { }
 
 	// This may be nil if we are not directly associated with a TCP
 	// analyzer (e.g., we're part of a tunnel decapsulation pipeline).
@@ -238,14 +238,14 @@ public:
 	// of ConnectionReset is delayed.
 	virtual void PacketWithRST();
 
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
-	virtual void Init();
+	void DeliverPacket(int len, const u_char* data, bool orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
+	void Init() override;
 
 	// This suppresses violations if the TCP connection wasn't
 	// fully established.
-	virtual void ProtocolViolation(const char* reason,
-					const char* data = 0, int len = 0);
+	void ProtocolViolation(const char* reason,
+					const char* data = 0, int len = 0) override;
 
 	// "name" and "val" both now belong to this object, which needs to
 	//  delete them when done with them.
@@ -260,7 +260,7 @@ public:
 	TCP_SupportAnalyzer(const char* name, Connection* conn, bool arg_orig)
 		: analyzer::SupportAnalyzer(name, conn, arg_orig)	{ }
 
-	virtual ~TCP_SupportAnalyzer() {}
+	~TCP_SupportAnalyzer() override {}
 
 	// These are passed on from TCP_Analyzer.
 	virtual void EndpointEOF(bool is_orig)	{ }
@@ -274,7 +274,7 @@ public:
 
 class TCPStats_Endpoint {
 public:
-	TCPStats_Endpoint(TCP_Endpoint* endp);
+	explicit TCPStats_Endpoint(TCP_Endpoint* endp);
 
 	int DataSent(double t, uint64 seq, int len, int caplen, const u_char* data,
 			const IP_Hdr* ip, const struct tcphdr* tp);
@@ -296,18 +296,18 @@ protected:
 
 class TCPStats_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	TCPStats_Analyzer(Connection* c);
-	~TCPStats_Analyzer();
+	explicit TCPStats_Analyzer(Connection* c);
+	~TCPStats_Analyzer() override;
 
-	virtual void Init();
-	virtual void Done();
+	void Init() override;
+	void Done() override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new TCPStats_Analyzer(conn); }
 
 protected:
-	virtual void DeliverPacket(int len, const u_char* data, bool is_orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
+	void DeliverPacket(int len, const u_char* data, bool is_orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
 
 	TCPStats_Endpoint* orig_stats;
 	TCPStats_Endpoint* resp_stats;
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.h b/src/analyzer/protocol/tcp/TCP_Reassembler.h
index 2e85e48e2f..bacfa663e0 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.h
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.h
@@ -22,7 +22,7 @@ public:
 	TCP_Reassembler(Analyzer* arg_dst_analyzer, TCP_Analyzer* arg_tcp_analyzer,
 	                Type arg_type, TCP_Endpoint* arg_endp);
 
-	virtual ~TCP_Reassembler();
+	~TCP_Reassembler() override;
 
 	void Done();
 
diff --git a/src/analyzer/protocol/teredo/Teredo.h b/src/analyzer/protocol/teredo/Teredo.h
index af733b8814..29eeadc968 100644
--- a/src/analyzer/protocol/teredo/Teredo.h
+++ b/src/analyzer/protocol/teredo/Teredo.h
@@ -9,17 +9,17 @@ namespace analyzer { namespace teredo {
 
 class Teredo_Analyzer : public analyzer::Analyzer {
 public:
-	Teredo_Analyzer(Connection* conn) : Analyzer("TEREDO", conn),
+	explicit Teredo_Analyzer(Connection* conn) : Analyzer("TEREDO", conn),
 	                                    valid_orig(false), valid_resp(false)
 		{}
 
-	virtual ~Teredo_Analyzer()
+	~Teredo_Analyzer() override
 		{}
 
-	virtual void Done();
+	void Done() override;
 
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
+	void DeliverPacket(int len, const u_char* data, bool orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new Teredo_Analyzer(conn); }
@@ -55,7 +55,7 @@ protected:
 
 class TeredoEncapsulation {
 public:
-	TeredoEncapsulation(const Teredo_Analyzer* ta)
+	explicit TeredoEncapsulation(const Teredo_Analyzer* ta)
 		: inner_ip(0), origin_indication(0), auth(0), analyzer(ta)
 		{}
 
diff --git a/src/analyzer/protocol/udp/UDP.h b/src/analyzer/protocol/udp/UDP.h
index ae00a4c61e..2c7f3ce150 100644
--- a/src/analyzer/protocol/udp/UDP.h
+++ b/src/analyzer/protocol/udp/UDP.h
@@ -15,22 +15,21 @@ typedef enum {
 
 class UDP_Analyzer : public analyzer::TransportLayerAnalyzer {
 public:
-	UDP_Analyzer(Connection* conn);
-	virtual ~UDP_Analyzer();
+	explicit UDP_Analyzer(Connection* conn);
+	~UDP_Analyzer() override;
 
-	virtual void Init();
-
-	virtual void UpdateConnVal(RecordVal *conn_val);
+	void Init() override;
+	void UpdateConnVal(RecordVal *conn_val) override;
 
 	static analyzer::Analyzer* Instantiate(Connection* conn)
 		{ return new UDP_Analyzer(conn); }
 
 protected:
-	virtual void Done();
-	virtual void DeliverPacket(int len, const u_char* data, bool orig,
-					uint64 seq, const IP_Hdr* ip, int caplen);
-	virtual bool IsReuse(double t, const u_char* pkt);
-	virtual unsigned int MemoryAllocation() const;
+	void Done() override;
+	void DeliverPacket(int len, const u_char* data, bool orig,
+					uint64 seq, const IP_Hdr* ip, int caplen) override;
+	bool IsReuse(double t, const u_char* pkt) override;
+	unsigned int MemoryAllocation() const override;
 
 	// Returns true if the checksum is valid, false if not
 	static bool ValidateChecksum(const IP_Hdr* ip, const struct udphdr* up,
diff --git a/src/analyzer/protocol/xmpp/XMPP.h b/src/analyzer/protocol/xmpp/XMPP.h
index 202403748a..595a86d56b 100644
--- a/src/analyzer/protocol/xmpp/XMPP.h
+++ b/src/analyzer/protocol/xmpp/XMPP.h
@@ -11,8 +11,8 @@ namespace analyzer { namespace xmpp {
 
 class XMPP_Analyzer : public tcp::TCP_ApplicationAnalyzer {
 public:
-	XMPP_Analyzer(Connection* conn);
-	virtual ~XMPP_Analyzer();
+	explicit XMPP_Analyzer(Connection* conn);
+	~XMPP_Analyzer() override;
 
 	void Done() override;
 	void DeliverStream(int len, const u_char* data, bool orig) override;
diff --git a/src/analyzer/protocol/zip/ZIP.h b/src/analyzer/protocol/zip/ZIP.h
index 580235ec63..de22803b26 100644
--- a/src/analyzer/protocol/zip/ZIP.h
+++ b/src/analyzer/protocol/zip/ZIP.h
@@ -15,11 +15,11 @@ public:
 	enum Method { GZIP, DEFLATE };
 
 	ZIP_Analyzer(Connection* conn, bool orig, Method method = GZIP);
-	~ZIP_Analyzer();
+	~ZIP_Analyzer() override;
 
-	virtual void Done();
+	void Done() override;
 
-	virtual void DeliverStream(int len, const u_char* data, bool orig);
+	void DeliverStream(int len, const u_char* data, bool orig) override;
 
 protected:
 	enum { NONE, ZIP_OK, ZIP_FAIL };
diff --git a/src/broxygen/Configuration.h b/src/broxygen/Configuration.h
index 7729c800b3..d41deb2c71 100644
--- a/src/broxygen/Configuration.h
+++ b/src/broxygen/Configuration.h
@@ -27,7 +27,7 @@ public:
 	 * an empty string most methods are a no-op.
 	 * @param delim The delimiter between target fields.
 	 */
-	Config(const std::string& file, const std::string& delim = "\t");
+	explicit Config(const std::string& file, const std::string& delim = "\t");
 
 	/**
 	  * Destructor, cleans up targets created when parsing config file.
diff --git a/src/broxygen/IdentifierInfo.h b/src/broxygen/IdentifierInfo.h
index 9a315ed3a5..be7e721838 100644
--- a/src/broxygen/IdentifierInfo.h
+++ b/src/broxygen/IdentifierInfo.h
@@ -36,7 +36,7 @@ public:
 	/**
 	 * Dtor.  Releases any references to script-level objects.
 	 */
-	~IdentifierInfo();
+	~IdentifierInfo() override;
 
 	/**
 	 * Add a comment associated with the identifier.  If the identifier is a
@@ -131,12 +131,12 @@ public:
 
 private:
 
-	time_t DoGetModificationTime() const;
+	time_t DoGetModificationTime() const override;
 
-	std::string DoName() const
+	std::string DoName() const override
 		{ return id->Name(); }
 
-	std::string DoReStructuredText(bool roles_only) const;
+	std::string DoReStructuredText(bool roles_only) const override;
 
 	struct RecordField {
 		~RecordField()
diff --git a/src/broxygen/PackageInfo.h b/src/broxygen/PackageInfo.h
index 67dd36da5f..967bbe3443 100644
--- a/src/broxygen/PackageInfo.h
+++ b/src/broxygen/PackageInfo.h
@@ -22,7 +22,7 @@ public:
 	 * @param name The name of the Bro script package (relative path from a
 	 * component within BROPATH.
 	 */
-	PackageInfo(const std::string& name);
+	explicit PackageInfo(const std::string& name);
 
 	/**
 	 * @return The content of the package's README file, each line being
@@ -34,12 +34,12 @@ public:
 
 private:
 
-	time_t DoGetModificationTime() const;
+	time_t DoGetModificationTime() const override;
 
-	std::string DoName() const
+	std::string DoName() const override
 		{ return pkg_name; }
 
-	std::string DoReStructuredText(bool roles_only) const;
+	std::string DoReStructuredText(bool roles_only) const override;
 
 	std::string pkg_name;
 	std::vector<std::string> readme;
diff --git a/src/broxygen/ReStructuredTextTable.h b/src/broxygen/ReStructuredTextTable.h
index c3679e6fac..34cc30c332 100644
--- a/src/broxygen/ReStructuredTextTable.h
+++ b/src/broxygen/ReStructuredTextTable.h
@@ -18,7 +18,7 @@ public:
 	 * Create the reST table object.
 	 * @param arg_num_cols The number of columns in the table.
 	 */
-	ReStructuredTextTable(size_t arg_num_cols);
+	explicit ReStructuredTextTable(size_t arg_num_cols);
 
 	/**
 	 * Add a new content row to the table.
diff --git a/src/broxygen/ScriptInfo.h b/src/broxygen/ScriptInfo.h
index 178ebdab44..d7328ef7c8 100644
--- a/src/broxygen/ScriptInfo.h
+++ b/src/broxygen/ScriptInfo.h
@@ -92,14 +92,14 @@ private:
 	typedef std::map<std::string, IdentifierInfo*> id_info_map;
 	typedef std::set<std::string> string_set;
 
-	time_t DoGetModificationTime() const;
+	time_t DoGetModificationTime() const override;
 
-	std::string DoName() const
+	std::string DoName() const override
 		{ return name; }
 
-	std::string DoReStructuredText(bool roles_only) const;
+	std::string DoReStructuredText(bool roles_only) const override;
 
-	void DoInitPostScript() /* override */;
+	void DoInitPostScript() override /* override */;
 
 	std::string name;
 	std::string path;
diff --git a/src/broxygen/Target.h b/src/broxygen/Target.h
index 1615ae090d..9a5a23107c 100644
--- a/src/broxygen/Target.h
+++ b/src/broxygen/Target.h
@@ -27,7 +27,7 @@ struct TargetFile {
 	 * directories that don't already exist.
 	 *
 	 */
-	TargetFile(const std::string& arg_name);
+	explicit TargetFile(const std::string& arg_name);
 
 	/**
 	 * Close the file.
@@ -185,9 +185,9 @@ protected:
 
 private:
 
-	void DoFindDependencies(const std::vector<Info*>& infos);
+	void DoFindDependencies(const std::vector<Info*>& infos) override;
 
-	void DoGenerate() const;
+	void DoGenerate() const override;
 
 	virtual void DoCreateAnalyzerDoc(FILE* f) const = 0;
 };
@@ -209,7 +209,7 @@ public:
 
 private:
 
-	void DoCreateAnalyzerDoc(FILE* f) const;
+	void DoCreateAnalyzerDoc(FILE* f) const override;
 };
 
 /**
@@ -229,7 +229,7 @@ public:
 
 private:
 
-	void DoCreateAnalyzerDoc(FILE* f) const;
+	void DoCreateAnalyzerDoc(FILE* f) const override;
 };
 
 /**
@@ -249,9 +249,9 @@ public:
 
 private:
 
-	void DoFindDependencies(const std::vector<Info*>& infos);
+	void DoFindDependencies(const std::vector<Info*>& infos) override;
 
-	void DoGenerate() const;
+	void DoGenerate() const override;
 
 	std::vector<PackageInfo*> pkg_deps;
 	std::vector<ScriptInfo*> script_deps;
@@ -276,9 +276,9 @@ public:
 
 private:
 
-	void DoFindDependencies(const std::vector<Info*>& infos);
+	void DoFindDependencies(const std::vector<Info*>& infos) override;
 
-	void DoGenerate() const;
+	void DoGenerate() const override;
 
 	std::vector<PackageInfo*> pkg_deps;
 };
@@ -301,7 +301,7 @@ public:
 		: Target(name, pattern), script_deps()
 		{ }
 
-	~ScriptTarget()
+	~ScriptTarget() override
 		{ for ( size_t i = 0; i < pkg_deps.size(); ++i ) delete pkg_deps[i]; }
 
 protected:
@@ -310,9 +310,9 @@ protected:
 
 private:
 
-	void DoFindDependencies(const std::vector<Info*>& infos);
+	void DoFindDependencies(const std::vector<Info*>& infos) override;
 
-	void DoGenerate() const;
+	void DoGenerate() const override;
 
 	bool IsDir() const
 		{ return Name()[Name().size() - 1] == '/'; }
@@ -337,7 +337,7 @@ public:
 
 private:
 
-	void DoGenerate() const /* override */;
+	void DoGenerate() const override /* override */;
 };
 
 /**
@@ -357,7 +357,7 @@ public:
 
 private:
 
-	void DoGenerate() const /* override */;
+	void DoGenerate() const override /* override */;
 };
 
 /**
@@ -377,9 +377,9 @@ public:
 
 private:
 
-	void DoFindDependencies(const std::vector<Info*>& infos);
+	void DoFindDependencies(const std::vector<Info*>& infos) override;
 
-	void DoGenerate() const;
+	void DoGenerate() const override;
 
 	std::vector<IdentifierInfo*> id_deps;
 };
diff --git a/src/file_analysis/AnalyzerSet.h b/src/file_analysis/AnalyzerSet.h
index 642792f776..3cbe5b1898 100644
--- a/src/file_analysis/AnalyzerSet.h
+++ b/src/file_analysis/AnalyzerSet.h
@@ -29,7 +29,7 @@ public:
 	 * Constructor.  Nothing special.
 	 * @param arg_file the file to which all analyzers in the set are attached.
 	 */
-	AnalyzerSet(File* arg_file);
+	explicit AnalyzerSet(File* arg_file);
 
 	/**
 	 * Destructor.  Any queued analyzer additions/removals are aborted and
@@ -173,9 +173,9 @@ private:
 		 */
 		AddMod(file_analysis::Analyzer* arg_a, HashKey* arg_key)
 			: Modification(), a(arg_a), key(arg_key) {}
-		virtual ~AddMod() {}
-		virtual bool Perform(AnalyzerSet* set);
-		virtual void Abort() { delete a; delete key; }
+		~AddMod() override {}
+		bool Perform(AnalyzerSet* set) override;
+		void Abort() override { delete a; delete key; }
 
 	protected:
 		file_analysis::Analyzer* a;
@@ -194,9 +194,9 @@ private:
 		 */
 		RemoveMod(file_analysis::Tag arg_tag, HashKey* arg_key)
 			: Modification(), tag(arg_tag), key(arg_key) {}
-		virtual ~RemoveMod() {}
-		virtual bool Perform(AnalyzerSet* set);
-		virtual void Abort() { delete key; }
+		~RemoveMod() override {}
+		bool Perform(AnalyzerSet* set) override;
+		void Abort() override { delete key; }
 
 	protected:
 		file_analysis::Tag tag;
diff --git a/src/file_analysis/Component.h b/src/file_analysis/Component.h
index 1a4d8a2fb6..b4bcbb9552 100644
--- a/src/file_analysis/Component.h
+++ b/src/file_analysis/Component.h
@@ -52,7 +52,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	~Component();
+	~Component() override;
 
 	/**
 	 * Initialization function. This function has to be called before any
diff --git a/src/file_analysis/FileReassembler.h b/src/file_analysis/FileReassembler.h
index aa07a84d42..c6143a5565 100644
--- a/src/file_analysis/FileReassembler.h
+++ b/src/file_analysis/FileReassembler.h
@@ -15,7 +15,7 @@ class FileReassembler : public Reassembler {
 public:
 
 	FileReassembler(File* f, uint64 starting_offset);
-	virtual ~FileReassembler();
+	~FileReassembler() override;
 
 	void Done();
 
diff --git a/src/file_analysis/FileTimer.h b/src/file_analysis/FileTimer.h
index bdfd1fe165..57f4afb5ea 100644
--- a/src/file_analysis/FileTimer.h
+++ b/src/file_analysis/FileTimer.h
@@ -28,7 +28,7 @@ public:
 	 * @param t current unix time
 	 * @param is_expire true if all pending timers are being expired.
 	 */
-	void Dispatch(double t, int is_expire);
+	void Dispatch(double t, int is_expire) override;
 
 private:
 	string file_id;
diff --git a/src/file_analysis/Tag.h b/src/file_analysis/Tag.h
index 33be048108..9d131fa808 100644
--- a/src/file_analysis/Tag.h
+++ b/src/file_analysis/Tag.h
@@ -97,14 +97,14 @@ protected:
 	 * @param subtype The sub type, which is left to an analyzer for
 	 * interpretation. By default it's set to zero.
 	 */
-	Tag(type_t type, subtype_t subtype = 0);
+	explicit Tag(type_t type, subtype_t subtype = 0);
 
 	/**
 	 * Constructor.
 	 *
 	 * @param val An enum value of script type \c Files::Tag.
 	 */
-	Tag(EnumVal* val) : ::Tag(val) {}
+	explicit Tag(EnumVal* val) : ::Tag(val) {}
 };
 
 }
diff --git a/src/file_analysis/analyzer/data_event/DataEvent.h b/src/file_analysis/analyzer/data_event/DataEvent.h
index 60b0487a6f..fe1fe2cc56 100644
--- a/src/file_analysis/analyzer/data_event/DataEvent.h
+++ b/src/file_analysis/analyzer/data_event/DataEvent.h
@@ -25,7 +25,7 @@ public:
 	 * @param offset number of bytes from start of file at which chunk occurs.
 	 * @return always true
 	 */
-	virtual bool DeliverChunk(const u_char* data, uint64 len, uint64 offset);
+	bool DeliverChunk(const u_char* data, uint64 len, uint64 offset) override;
 
 	/**
 	 * Generates the event, if any, specified by the "stream_event" field of
@@ -34,7 +34,7 @@ public:
 	 * @param len number of bytes in the data chunk.
 	 * @return always true
 	 */
-	virtual bool DeliverStream(const u_char* data, uint64 len);
+	bool DeliverStream(const u_char* data, uint64 len) override;
 
 	/**
 	 * Create a new instance of a DataEvent analyzer.
diff --git a/src/file_analysis/analyzer/entropy/Entropy.h b/src/file_analysis/analyzer/entropy/Entropy.h
index 6a5075263c..955c8484c2 100644
--- a/src/file_analysis/analyzer/entropy/Entropy.h
+++ b/src/file_analysis/analyzer/entropy/Entropy.h
@@ -23,7 +23,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	virtual ~Entropy();
+	~Entropy() override;
 
 	/**
 	 * Create a new instance of an Extract analyzer.
@@ -40,13 +40,13 @@ public:
 	 * @param len number of bytes in the data chunk.
 	 * @return false if the digest is in an invalid state, else true.
 	 */
-	virtual bool DeliverStream(const u_char* data, uint64 len);
+	bool DeliverStream(const u_char* data, uint64 len) override;
 
 	/**
 	 * Finalizes the hash and raises a "file_entropy_test" event.
 	 * @return always false so analyze will be deteched from file.
 	 */
-	virtual bool EndOfFile();
+	bool EndOfFile() override;
 
 	/**
 	 * Missing data can't be handled, so just indicate the this analyzer should
@@ -55,7 +55,7 @@ public:
 	 * @param len number of missing bytes.
 	 * @return always false so analyzer will detach from file.
 	 */
-	virtual bool Undelivered(uint64 offset, uint64 len);
+	bool Undelivered(uint64 offset, uint64 len) override;
 
 protected:
 
diff --git a/src/file_analysis/analyzer/extract/Extract.h b/src/file_analysis/analyzer/extract/Extract.h
index cb57950d4c..c19440ee31 100644
--- a/src/file_analysis/analyzer/extract/Extract.h
+++ b/src/file_analysis/analyzer/extract/Extract.h
@@ -22,7 +22,7 @@ public:
 	/**
 	 * Destructor.  Will close the file that was used for data extraction.
 	 */
-	virtual ~Extract();
+	~Extract() override;
 
 	/**
 	 * Write a chunk of file data to the local extraction file.
@@ -31,7 +31,7 @@ public:
 	 * @return false if there was no extraction file open and the data couldn't
 	 *         be written, else true.
 	 */
-	virtual bool DeliverStream(const u_char* data, uint64 len);
+	bool DeliverStream(const u_char* data, uint64 len) override;
 
 	/**
 	 * Report undelivered bytes.
@@ -39,7 +39,7 @@ public:
 	 * @param len number of bytes undelivered.
 	 * @return true
 	 */
-	virtual bool Undelivered(uint64 offset, uint64 len);
+	bool Undelivered(uint64 offset, uint64 len) override;
 
 	/**
 	 * Create a new instance of an Extract analyzer.
diff --git a/src/file_analysis/analyzer/hash/Hash.h b/src/file_analysis/analyzer/hash/Hash.h
index 13303e21fc..f3ec222e9a 100644
--- a/src/file_analysis/analyzer/hash/Hash.h
+++ b/src/file_analysis/analyzer/hash/Hash.h
@@ -23,7 +23,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	virtual ~Hash();
+	~Hash() override;
 
 	/**
 	 * Incrementally hash next chunk of file contents.
@@ -31,13 +31,13 @@ public:
 	 * @param len number of bytes in the data chunk.
 	 * @return false if the digest is in an invalid state, else true.
 	 */
-	virtual bool DeliverStream(const u_char* data, uint64 len);
+	bool DeliverStream(const u_char* data, uint64 len) override;
 
 	/**
 	 * Finalizes the hash and raises a "file_hash" event.
 	 * @return always false so analyze will be deteched from file.
 	 */
-	virtual bool EndOfFile();
+	bool EndOfFile() override;
 
 	/**
 	 * Missing data can't be handled, so just indicate the this analyzer should
@@ -46,7 +46,7 @@ public:
 	 * @param len number of missing bytes.
 	 * @return always false so analyzer will detach from file.
 	 */
-	virtual bool Undelivered(uint64 offset, uint64 len);
+	bool Undelivered(uint64 offset, uint64 len) override;
 
 protected:
 
diff --git a/src/file_analysis/analyzer/unified2/Unified2.h b/src/file_analysis/analyzer/unified2/Unified2.h
index c2ee9e00da..b2e289c726 100644
--- a/src/file_analysis/analyzer/unified2/Unified2.h
+++ b/src/file_analysis/analyzer/unified2/Unified2.h
@@ -17,9 +17,9 @@ namespace file_analysis {
  */
 class Unified2 : public file_analysis::Analyzer {
 public:
-	virtual ~Unified2();
+	~Unified2() override;
 
-	virtual bool DeliverStream(const u_char* data, uint64 len);
+	bool DeliverStream(const u_char* data, uint64 len) override;
 
 	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file);
 
diff --git a/src/file_analysis/analyzer/x509/OCSP.h b/src/file_analysis/analyzer/x509/OCSP.h
index d1d15dd14f..ca8c2c563e 100644
--- a/src/file_analysis/analyzer/x509/OCSP.h
+++ b/src/file_analysis/analyzer/x509/OCSP.h
@@ -40,7 +40,7 @@ private:
 class OCSP_RESPVal: public OpaqueVal {
 public:
 	explicit OCSP_RESPVal(OCSP_RESPONSE *);
-	~OCSP_RESPVal();
+	~OCSP_RESPVal() override;
 	OCSP_RESPONSE *GetResp() const;
 protected:
 	OCSP_RESPVal();
diff --git a/src/file_analysis/analyzer/x509/X509.h b/src/file_analysis/analyzer/x509/X509.h
index 8cf74fc4c6..b808b676fe 100644
--- a/src/file_analysis/analyzer/x509/X509.h
+++ b/src/file_analysis/analyzer/x509/X509.h
@@ -121,7 +121,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	~X509Val();
+	~X509Val() override;
 
 	/**
 	 * Get the wrapped X509 certificate. Please take care, that the
diff --git a/src/file_analysis/analyzer/x509/X509Common.h b/src/file_analysis/analyzer/x509/X509Common.h
index 7e9bdd9be4..a7015bc235 100644
--- a/src/file_analysis/analyzer/x509/X509Common.h
+++ b/src/file_analysis/analyzer/x509/X509Common.h
@@ -16,7 +16,7 @@ namespace file_analysis {
 
 class X509Common : public file_analysis::Analyzer {
 public:
-	virtual ~X509Common() {};
+	~X509Common() override {};
 
 	/**
 	 * Retrieve an X509 extension value from an OpenSSL BIO to which it was
diff --git a/src/input/Component.h b/src/input/Component.h
index ce24d447e5..cd3c1ea24d 100644
--- a/src/input/Component.h
+++ b/src/input/Component.h
@@ -37,7 +37,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	~Component();
+	~Component() override;
 
 	/**
 	 * Initialization function. This function has to be called before any
diff --git a/src/input/ReaderBackend.h b/src/input/ReaderBackend.h
index 944f059fb1..84f6635da5 100644
--- a/src/input/ReaderBackend.h
+++ b/src/input/ReaderBackend.h
@@ -68,7 +68,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	virtual ~ReaderBackend();
+	~ReaderBackend() override;
 
 	/**
 	 * A struct passing information to the reader at initialization time.
diff --git a/src/input/Tag.h b/src/input/Tag.h
index 78dd65676f..91d7539a39 100644
--- a/src/input/Tag.h
+++ b/src/input/Tag.h
@@ -98,14 +98,14 @@ protected:
 	 * @param subtype The sub type, which is left to an reader for
 	 * interpretation. By default it's set to zero.
 	 */
-	Tag(type_t type, subtype_t subtype = 0);
+	explicit Tag(type_t type, subtype_t subtype = 0);
 
 	/**
 	 * Constructor.
 	 *
 	 * @param val An enum value of script type \c Input::Reader.
 	 */
-	Tag(EnumVal* val) : ::Tag(val) {}
+	explicit Tag(EnumVal* val) : ::Tag(val) {}
 };
 
 }
diff --git a/src/input/readers/ascii/Ascii.h b/src/input/readers/ascii/Ascii.h
index 7a7fa52590..130fc25075 100644
--- a/src/input/readers/ascii/Ascii.h
+++ b/src/input/readers/ascii/Ascii.h
@@ -36,7 +36,7 @@ struct FieldMapping {
 class Ascii : public ReaderBackend {
 public:
 	explicit Ascii(ReaderFrontend* frontend);
-	~Ascii();
+	~Ascii() override;
 
 	// prohibit copying and moving
 	Ascii(const Ascii&) = delete;
diff --git a/src/input/readers/benchmark/Benchmark.h b/src/input/readers/benchmark/Benchmark.h
index 42501c1c29..2c71845723 100644
--- a/src/input/readers/benchmark/Benchmark.h
+++ b/src/input/readers/benchmark/Benchmark.h
@@ -13,16 +13,16 @@ namespace input { namespace reader {
  */
 class Benchmark : public ReaderBackend {
 public:
-	Benchmark(ReaderFrontend* frontend);
-	~Benchmark();
+	explicit Benchmark(ReaderFrontend* frontend);
+	~Benchmark() override;
 
 	static ReaderBackend* Instantiate(ReaderFrontend* frontend) { return new Benchmark(frontend); }
 
 protected:
-	virtual bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields);
-	virtual void DoClose();
-	virtual bool DoUpdate();
-	virtual bool DoHeartbeat(double network_time, double current_time);
+	bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* fields) override;
+	void DoClose() override;
+	bool DoUpdate() override;
+	bool DoHeartbeat(double network_time, double current_time) override;
 
 private:
 	double CurrTime();
diff --git a/src/input/readers/binary/Binary.h b/src/input/readers/binary/Binary.h
index 587d56cfa7..6fd5a3b001 100644
--- a/src/input/readers/binary/Binary.h
+++ b/src/input/readers/binary/Binary.h
@@ -14,19 +14,18 @@ namespace input { namespace reader {
  */
 class Binary : public ReaderBackend {
 public:
-	Binary(ReaderFrontend* frontend);
-
-	~Binary();
+	explicit Binary(ReaderFrontend* frontend);
+	~Binary() override;
 
 	static ReaderBackend* Instantiate(ReaderFrontend* frontend)
 		{ return new Binary(frontend); }
 
 protected:
-	virtual bool DoInit(const ReaderInfo& info, int arg_num_fields,
-	                    const threading::Field* const* fields);
-	virtual void DoClose();
-	virtual bool DoUpdate();
-	virtual bool DoHeartbeat(double network_time, double current_time);
+	bool DoInit(const ReaderInfo& info, int arg_num_fields,
+	            const threading::Field* const* fields) override;
+	void DoClose() override;
+	bool DoUpdate() override;
+	bool DoHeartbeat(double network_time, double current_time) override;
 
 private:
 	bool OpenInput();
diff --git a/src/input/readers/config/Config.h b/src/input/readers/config/Config.h
index 05f1f6b767..b0dc83f725 100644
--- a/src/input/readers/config/Config.h
+++ b/src/input/readers/config/Config.h
@@ -20,7 +20,7 @@ namespace input { namespace reader {
 class Config : public ReaderBackend {
 public:
 	explicit Config(ReaderFrontend* frontend);
-	~Config();
+	~Config() override;
 
 	// prohibit copying and moving
 	Config(const Config&) = delete;
diff --git a/src/input/readers/raw/Plugin.h b/src/input/readers/raw/Plugin.h
index 8b7f9edc10..31fa611130 100644
--- a/src/input/readers/raw/Plugin.h
+++ b/src/input/readers/raw/Plugin.h
@@ -13,10 +13,10 @@ class Plugin : public plugin::Plugin {
 public:
 	Plugin();
 
-	plugin::Configuration Configure();
+	plugin::Configuration Configure() override;
 
-	virtual void InitPreScript();
-	virtual void Done();
+	void InitPreScript() override;
+	void Done() override;
 
 	std::unique_lock<std::mutex> ForkMutex();
 
diff --git a/src/input/readers/raw/Raw.h b/src/input/readers/raw/Raw.h
index ec50ade8fe..c6075cbe70 100644
--- a/src/input/readers/raw/Raw.h
+++ b/src/input/readers/raw/Raw.h
@@ -18,7 +18,7 @@ namespace input { namespace reader {
 class Raw : public ReaderBackend {
 public:
 	explicit Raw(ReaderFrontend* frontend);
-	~Raw();
+	~Raw() override;
 
 	// prohibit copying and moving
 	Raw(const Raw&) = delete;
diff --git a/src/input/readers/sqlite/SQLite.h b/src/input/readers/sqlite/SQLite.h
index 5add678b16..2aa01017e1 100644
--- a/src/input/readers/sqlite/SQLite.h
+++ b/src/input/readers/sqlite/SQLite.h
@@ -16,16 +16,16 @@ namespace input { namespace reader {
 
 class SQLite : public ReaderBackend {
 public:
-	SQLite(ReaderFrontend* frontend);
-	~SQLite();
+	explicit SQLite(ReaderFrontend* frontend);
+	~SQLite() override;
 
 	static ReaderBackend* Instantiate(ReaderFrontend* frontend) { return new SQLite(frontend); }
 
 protected:
-	virtual bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* arg_fields);
-	virtual void DoClose();
-	virtual bool DoUpdate();
-	virtual bool DoHeartbeat(double network_time, double current_time)	{ return true; }
+	bool DoInit(const ReaderInfo& info, int arg_num_fields, const threading::Field* const* arg_fields) override;
+	void DoClose() override;
+	bool DoUpdate() override;
+	bool DoHeartbeat(double network_time, double current_time) override { return true; }
 
 private:
 	bool checkError(int code);
diff --git a/src/iosource/Component.h b/src/iosource/Component.h
index 57e1084d3a..2d9d19e799 100644
--- a/src/iosource/Component.h
+++ b/src/iosource/Component.h
@@ -27,12 +27,12 @@ public:
 	 * @param name A descriptive name for the component.  This name must
 	 * be unique across all components of this type.
 	 */
-	Component(const std::string& name);
+	explicit Component(const std::string& name);
 
 	/**
 	 * Destructor.
 	 */
-	~Component();
+	~Component() override;
 
 protected:
 	/**
@@ -80,7 +80,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	virtual ~PktSrcComponent();
+	~PktSrcComponent() override;
 
 	/**
 	 * Returns the prefix(es) passed to the constructor.
@@ -113,7 +113,7 @@ public:
 	 * Generates a human-readable description of the component. This goes
 	 * into the output of \c "bro -NN".
 	 */
-	virtual void DoDescribe(ODesc* d) const;
+	void DoDescribe(ODesc* d) const override;
 
 private:
 	std::vector<std::string> prefixes;
@@ -139,7 +139,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	~PktDumperComponent();
+	~PktDumperComponent() override;
 
 	/**
 	 * Returns the prefix(es) passed to the constructor.
@@ -160,7 +160,7 @@ public:
 	 * Generates a human-readable description of the component. This goes
 	 * into the output of \c "bro -NN".
 	 */
-	virtual void DoDescribe(ODesc* d) const;
+	void DoDescribe(ODesc* d) const override;
 
 private:
 	std::vector<std::string> prefixes;
diff --git a/src/iosource/PktSrc.h b/src/iosource/PktSrc.h
index f2f14aa9c2..dcf5f38de8 100644
--- a/src/iosource/PktSrc.h
+++ b/src/iosource/PktSrc.h
@@ -57,7 +57,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	virtual ~PktSrc();
+	~PktSrc() override;
 
 	/**
 	 * Returns the path associated with the source. This is the interface
@@ -345,13 +345,13 @@ private:
 	bool ExtractNextPacketInternal();
 
 	// IOSource interface implementation.
-	virtual void Init();
-	virtual void Done();
-	virtual void GetFds(iosource::FD_Set* read, iosource::FD_Set* write,
-	                    iosource::FD_Set* except);
-	virtual double NextTimestamp(double* local_network_time);
-	virtual void Process();
-	virtual const char* Tag();
+	void Init() override;
+	void Done() override;
+	void GetFds(iosource::FD_Set* read, iosource::FD_Set* write,
+	                    iosource::FD_Set* except) override;
+	double NextTimestamp(double* local_network_time) override;
+	void Process() override;
+	const char* Tag() override;
 
 	Properties props;
 
diff --git a/src/iosource/pcap/Dumper.h b/src/iosource/pcap/Dumper.h
index 7950912d56..19defc627f 100644
--- a/src/iosource/pcap/Dumper.h
+++ b/src/iosource/pcap/Dumper.h
@@ -15,15 +15,15 @@ namespace pcap {
 class PcapDumper : public PktDumper {
 public:
 	PcapDumper(const std::string& path, bool append);
-	virtual ~PcapDumper();
+	~PcapDumper() override;
 
 	static PktDumper* Instantiate(const std::string& path, bool appen);
 
 protected:
 	// PktDumper interface.
-	virtual void Open();
-	virtual void Close();
-	virtual bool Dump(const Packet* pkt);
+	void Open() override;
+	void Close() override;
+	bool Dump(const Packet* pkt) override;
 
 private:
 	Properties props;
diff --git a/src/iosource/pcap/Source.h b/src/iosource/pcap/Source.h
index f3c193d855..1672d1c10f 100644
--- a/src/iosource/pcap/Source.h
+++ b/src/iosource/pcap/Source.h
@@ -11,19 +11,19 @@ namespace pcap {
 class PcapSource : public iosource::PktSrc {
 public:
 	PcapSource(const std::string& path, bool is_live);
-	virtual ~PcapSource();
+	~PcapSource() override;
 
 	static PktSrc* Instantiate(const std::string& path, bool is_live);
 
 protected:
 	// PktSrc interface.
-	virtual void Open();
-	virtual void Close();
-	virtual bool ExtractNextPacket(Packet* pkt);
-	virtual void DoneWithPacket();
-	virtual bool PrecompileFilter(int index, const std::string& filter);
-	virtual bool SetFilter(int index);
-	virtual void Statistics(Stats* stats);
+	void Open() override;
+	void Close() override;
+	bool ExtractNextPacket(Packet* pkt) override;
+	void DoneWithPacket() override;
+	bool PrecompileFilter(int index, const std::string& filter) override;
+	bool SetFilter(int index) override;
+	void Statistics(Stats* stats) override;
 
 private:
 	void OpenLive();
diff --git a/src/logging/Component.h b/src/logging/Component.h
index a7ef2a0c31..d99803b165 100644
--- a/src/logging/Component.h
+++ b/src/logging/Component.h
@@ -37,7 +37,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	~Component();
+	~Component() override;
 
 	/**
 	 * Initialization function. This function has to be called before any
diff --git a/src/logging/Tag.h b/src/logging/Tag.h
index bcb7af946b..ab0a702d47 100644
--- a/src/logging/Tag.h
+++ b/src/logging/Tag.h
@@ -98,14 +98,14 @@ protected:
 	 * @param subtype The sub type, which is left to an writer for
 	 * interpretation. By default it's set to zero.
 	 */
-	Tag(type_t type, subtype_t subtype = 0);
+	explicit Tag(type_t type, subtype_t subtype = 0);
 
 	/**
 	 * Constructor.
 	 *
 	 * @param val An enum value of script type \c Log::Writer.
 	 */
-	Tag(EnumVal* val) : ::Tag(val) {}
+	explicit Tag(EnumVal* val) : ::Tag(val) {}
 };
 
 }
diff --git a/src/logging/WriterBackend.h b/src/logging/WriterBackend.h
index f6602cc8ca..49c7a95857 100644
--- a/src/logging/WriterBackend.h
+++ b/src/logging/WriterBackend.h
@@ -47,7 +47,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	virtual ~WriterBackend();
+	~WriterBackend() override;
 
 	/**
 	 * A struct passing information to the writer at initialization time.
diff --git a/src/logging/writers/ascii/Ascii.h b/src/logging/writers/ascii/Ascii.h
index eabeda4242..d1a6f2d0f3 100644
--- a/src/logging/writers/ascii/Ascii.h
+++ b/src/logging/writers/ascii/Ascii.h
@@ -14,8 +14,8 @@ namespace logging { namespace writer {
 
 class Ascii : public WriterBackend {
 public:
-	Ascii(WriterFrontend* frontend);
-	~Ascii();
+	explicit Ascii(WriterFrontend* frontend);
+	~Ascii() override;
 
 	static string LogExt();
 
@@ -23,19 +23,19 @@ public:
 		{ return new Ascii(frontend); }
 
 protected:
-	virtual bool DoInit(const WriterInfo& info, int num_fields,
-			    const threading::Field* const* fields);
-	virtual bool DoWrite(int num_fields, const threading::Field* const* fields,
-			     threading::Value** vals);
-	virtual bool DoSetBuf(bool enabled);
-	virtual bool DoRotate(const char* rotated_path, double open,
-			      double close, bool terminating);
-	virtual bool DoFlush(double network_time);
-	virtual bool DoFinish(double network_time);
-	virtual bool DoHeartbeat(double network_time, double current_time);
+	bool DoInit(const WriterInfo& info, int num_fields,
+			    const threading::Field* const* fields) override;
+	bool DoWrite(int num_fields, const threading::Field* const* fields,
+			     threading::Value** vals) override;
+	bool DoSetBuf(bool enabled) override;
+	bool DoRotate(const char* rotated_path, double open,
+			      double close, bool terminating) override;
+	bool DoFlush(double network_time) override;
+	bool DoFinish(double network_time) override;
+	bool DoHeartbeat(double network_time, double current_time) override;
 
 private:
-	bool IsSpecial(string path) 	{ return path.find("/dev/") == 0; }
+	bool IsSpecial(const string &path) 	{ return path.find("/dev/") == 0; }
 	bool WriteHeader(const string& path);
 	bool WriteHeaderField(const string& key, const string& value);
 	void CloseFile(double t);
diff --git a/src/logging/writers/none/None.h b/src/logging/writers/none/None.h
index fda9a35330..24193341b5 100644
--- a/src/logging/writers/none/None.h
+++ b/src/logging/writers/none/None.h
@@ -11,24 +11,23 @@ namespace logging { namespace writer {
 
 class None : public WriterBackend {
 public:
-	None(WriterFrontend* frontend) : WriterBackend(frontend)	{}
-	~None()	{};
+	explicit None(WriterFrontend* frontend) : WriterBackend(frontend)	{}
+	~None() override {};
 
 	static WriterBackend* Instantiate(WriterFrontend* frontend)
 		{ return new None(frontend); }
 
 protected:
-	virtual bool DoInit(const WriterInfo& info, int num_fields,
-			    const threading::Field* const * fields);
-
-	virtual bool DoWrite(int num_fields, const threading::Field* const* fields,
-			     threading::Value** vals)	{ return true; }
-	virtual bool DoSetBuf(bool enabled)	{ return true; }
-	virtual bool DoRotate(const char* rotated_path, double open,
-			      double close, bool terminating);
-	virtual bool DoFlush(double network_time)	{ return true; }
-	virtual bool DoFinish(double network_time)	{ return true; }
-	virtual bool DoHeartbeat(double network_time, double current_time)	{ return true; }
+	bool DoInit(const WriterInfo& info, int num_fields,
+			    const threading::Field* const * fields) override;
+	bool DoWrite(int num_fields, const threading::Field* const* fields,
+			     threading::Value** vals) override { return true; }
+	bool DoSetBuf(bool enabled) override { return true; }
+	bool DoRotate(const char* rotated_path, double open,
+			      double close, bool terminating) override;
+	bool DoFlush(double network_time) override { return true; }
+	bool DoFinish(double network_time) override { return true; }
+	bool DoHeartbeat(double network_time, double current_time) override { return true; }
 };
 
 }
diff --git a/src/logging/writers/sqlite/Plugin.cc b/src/logging/writers/sqlite/Plugin.cc
index 75e6497c99..f48ec838f1 100644
--- a/src/logging/writers/sqlite/Plugin.cc
+++ b/src/logging/writers/sqlite/Plugin.cc
@@ -10,7 +10,7 @@ namespace Bro_SQLiteWriter {
 
 class Plugin : public plugin::Plugin {
 public:
-	plugin::Configuration Configure()
+	plugin::Configuration Configure() override
 		{
 		AddComponent(new ::logging::Component("SQLite", ::logging::writer::SQLite::Instantiate));
 
diff --git a/src/logging/writers/sqlite/SQLite.h b/src/logging/writers/sqlite/SQLite.h
index 1db53614a2..3ad535e543 100644
--- a/src/logging/writers/sqlite/SQLite.h
+++ b/src/logging/writers/sqlite/SQLite.h
@@ -15,23 +15,23 @@ namespace logging { namespace writer {
 
 class SQLite : public WriterBackend {
 public:
-	SQLite(WriterFrontend* frontend);
-	~SQLite();
+	explicit SQLite(WriterFrontend* frontend);
+	~SQLite() override;
 
 	static WriterBackend* Instantiate(WriterFrontend* frontend)
 		{ return new SQLite(frontend); }
 
 protected:
-	virtual bool DoInit(const WriterInfo& info, int arg_num_fields,
-			    const threading::Field* const* arg_fields);
-	virtual bool DoWrite(int num_fields, const threading::Field* const* fields,
-			     threading::Value** vals);
-	virtual bool DoSetBuf(bool enabled) { return true; }
-	virtual bool DoRotate(const char* rotated_path, double open,
-			      double close, bool terminating);
-	virtual bool DoFlush(double network_time)	{ return true; }
-	virtual bool DoFinish(double network_time)	{ return true; }
-	virtual bool DoHeartbeat(double network_time, double current_time)	{ return true; }
+	bool DoInit(const WriterInfo& info, int arg_num_fields,
+			    const threading::Field* const* arg_fields) override;
+	bool DoWrite(int num_fields, const threading::Field* const* fields,
+			     threading::Value** vals) override;
+	bool DoSetBuf(bool enabled) override { return true; }
+	bool DoRotate(const char* rotated_path, double open,
+			      double close, bool terminating) override;
+	bool DoFlush(double network_time) override { return true; }
+	bool DoFinish(double network_time) override { return true; }
+	bool DoHeartbeat(double network_time, double current_time) override { return true; }
 
 private:
 	bool checkError(int code);
diff --git a/src/plugin/TaggedComponent.h b/src/plugin/TaggedComponent.h
index 4c7adc1bd6..2d507660c2 100644
--- a/src/plugin/TaggedComponent.h
+++ b/src/plugin/TaggedComponent.h
@@ -25,7 +25,7 @@ public:
 	 * and component instances can accordingly access it via Tag().
 	 * If not used, leave at zero.
 	 */
-	TaggedComponent(typename T::subtype_t subtype = 0);
+	explicit TaggedComponent(typename T::subtype_t subtype = 0);
 
 	/**
 	 * Initializes tag by creating the unique tag value for thos componend.
diff --git a/src/probabilistic/BloomFilter.h b/src/probabilistic/BloomFilter.h
index 7fc32a9442..288a24d416 100644
--- a/src/probabilistic/BloomFilter.h
+++ b/src/probabilistic/BloomFilter.h
@@ -19,7 +19,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	virtual ~BloomFilter();
+	~BloomFilter() override;
 
 	/**
 	 * Adds an element to the Bloom filter.
@@ -103,7 +103,7 @@ protected:
 	 *
 	 * @param hasher The hasher to use for this Bloom filter.
 	 */
-	BloomFilter(const Hasher* hasher);
+	explicit BloomFilter(const Hasher* hasher);
 
 	const Hasher* hasher;
 };
@@ -127,7 +127,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	~BasicBloomFilter();
+	~BasicBloomFilter() override;
 
 	/**
 	 * Computes the number of cells based on a given false positive rate
@@ -158,11 +158,11 @@ public:
 	static size_t K(size_t cells, size_t capacity);
 
 	// Overridden from BloomFilter.
-	virtual bool Empty() const override;
-	virtual void Clear() override;
-	virtual bool Merge(const BloomFilter* other) override;
-	virtual BasicBloomFilter* Clone() const override;
-	virtual string InternalState() const override;
+	bool Empty() const override;
+	void Clear() override;
+	bool Merge(const BloomFilter* other) override;
+	BasicBloomFilter* Clone() const override;
+	string InternalState() const override;
 
 protected:
 	DECLARE_SERIAL(BasicBloomFilter);
@@ -173,8 +173,8 @@ protected:
 	BasicBloomFilter();
 
 	// Overridden from BloomFilter.
-	virtual void Add(const HashKey* key) override;
-	virtual size_t Count(const HashKey* key) const override;
+	void Add(const HashKey* key) override;
+	size_t Count(const HashKey* key) const override;
 
 private:
 	BitVector* bits;
@@ -200,14 +200,14 @@ public:
 	/**
 	 * Destructor.
 	 */
-	~CountingBloomFilter();
+	~CountingBloomFilter() override;
 
 	// Overridden from BloomFilter.
-	virtual bool Empty() const override;
-	virtual void Clear() override;
-	virtual bool Merge(const BloomFilter* other) override;
-	virtual CountingBloomFilter* Clone() const override;
-	virtual string InternalState() const override;
+	bool Empty() const override;
+	void Clear() override;
+	bool Merge(const BloomFilter* other) override;
+	CountingBloomFilter* Clone() const override;
+	string InternalState() const override;
 
 protected:
 	DECLARE_SERIAL(CountingBloomFilter);
@@ -218,8 +218,8 @@ protected:
 	CountingBloomFilter();
 
 	// Overridden from BloomFilter.
-	virtual void Add(const HashKey* key) override;
-	virtual size_t Count(const HashKey* key) const override;
+	void Add(const HashKey* key) override;
+	size_t Count(const HashKey* key) const override;
 
 private:
 	CounterVector* cells;
diff --git a/src/probabilistic/CounterVector.h b/src/probabilistic/CounterVector.h
index 247a646eb1..422d172292 100644
--- a/src/probabilistic/CounterVector.h
+++ b/src/probabilistic/CounterVector.h
@@ -26,7 +26,7 @@ public:
 	 *
 	 * @pre `cells > 0 && width > 0`
 	 */
-	CounterVector(size_t width, size_t cells = 1024);
+	explicit CounterVector(size_t width, size_t cells = 1024);
 
 	/**
 	 * Copy-constructs a counter vector.
@@ -38,7 +38,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	~CounterVector();
+	~CounterVector() override;
 
 	/**
 	 * Increments a given cell.
diff --git a/src/probabilistic/Hasher.h b/src/probabilistic/Hasher.h
index da83104e9d..7fd2e4fb2f 100644
--- a/src/probabilistic/Hasher.h
+++ b/src/probabilistic/Hasher.h
@@ -43,7 +43,7 @@ public:
 	/**
 	 * Destructor.
 	 */
-	virtual ~Hasher() { }
+	~Hasher() override { }
 
 	/**
 	 * Computes hash values for an element.
@@ -138,7 +138,7 @@ public:
 	 *
 	 * @param arg_seed The seed to use for this instance.
 	 */
-	UHF(Hasher::seed_t arg_seed);
+	explicit UHF(Hasher::seed_t arg_seed);
 
 	template <typename T>
 	Hasher::digest operator()(const T& x) const
@@ -204,9 +204,9 @@ public:
 	DefaultHasher(size_t k, Hasher::seed_t seed);
 
 	// Overridden from Hasher.
-	virtual digest_vector Hash(const void* x, size_t n) const final;
-	virtual DefaultHasher* Clone() const final;
-	virtual bool Equals(const Hasher* other) const final;
+	digest_vector Hash(const void* x, size_t n) const final;
+	DefaultHasher* Clone() const final;
+	bool Equals(const Hasher* other) const final;
 
 	DECLARE_SERIAL(DefaultHasher);
 
@@ -232,9 +232,9 @@ public:
 	DoubleHasher(size_t k, Hasher::seed_t seed);
 
 	// Overridden from Hasher.
-	virtual digest_vector Hash(const void* x, size_t n) const final;
-	virtual DoubleHasher* Clone() const final;
-	virtual bool Equals(const Hasher* other) const final;
+	digest_vector Hash(const void* x, size_t n) const final;
+	DoubleHasher* Clone() const final;
+	bool Equals(const Hasher* other) const final;
 
 	DECLARE_SERIAL(DoubleHasher);
 
diff --git a/src/probabilistic/Topk.h b/src/probabilistic/Topk.h
index a9a0d80818..fac677a454 100644
--- a/src/probabilistic/Topk.h
+++ b/src/probabilistic/Topk.h
@@ -45,12 +45,12 @@ public:
 	 *
 	 * @return A newly initialized TopkVal
 	 */
-	TopkVal(uint64 size);
+	explicit TopkVal(uint64 size);
 
 	/**
 	 * Destructor.
 	 */
-	~TopkVal();
+	~TopkVal() override;
 
 	/**
 	 * Call this when a new value is encountered. Note that on the first
diff --git a/src/threading/Manager.h b/src/threading/Manager.h
index 70e592fa10..dce35cde3a 100644
--- a/src/threading/Manager.h
+++ b/src/threading/Manager.h
@@ -33,7 +33,7 @@ public:
 	/**
 	 * Destructir.
 	 */
-	~Manager();
+	~Manager() override;
 
 	/**
 	 * Terminates the manager's processor. The method signals all threads
@@ -103,23 +103,23 @@ protected:
 	/**
 	 * Part of the IOSource interface.
 	 */
-	virtual void GetFds(iosource::FD_Set* read, iosource::FD_Set* write,
-	                    iosource::FD_Set* except);
+	void GetFds(iosource::FD_Set* read, iosource::FD_Set* write,
+	                    iosource::FD_Set* except) override;
 
 	/**
 	 * Part of the IOSource interface.
 	 */
-	virtual double NextTimestamp(double* network_time);
+	double NextTimestamp(double* network_time) override;
 
 	/**
 	 * Part of the IOSource interface.
 	 */
-	virtual void Process();
+	void Process() override;
 
 	/**
 	 * Part of the IOSource interface.
 	 */
-	virtual const char* Tag()	{ return "threading::Manager"; }
+	const char* Tag() override { return "threading::Manager"; }
 
 private:
 	typedef std::list<BasicThread*> all_thread_list;
diff --git a/src/threading/MsgThread.h b/src/threading/MsgThread.h
index 480ab2974c..60da2d9668 100644
--- a/src/threading/MsgThread.h
+++ b/src/threading/MsgThread.h
@@ -339,7 +339,7 @@ protected:
 	 * @param arg_name A descriptive name for the type of message. Used
 	 * mainly for debugging purposes.
 	 */
-	Message(const char* arg_name)
+	explicit Message(const char* arg_name)
 		{ name = copy_string(arg_name); }
 
 private:
@@ -358,7 +358,7 @@ protected:
 	 * @param name A descriptive name for the type of message. Used
 	 * mainly for debugging purposes.
 	 */
-	BasicInputMessage(const char* name) : Message(name)	{}
+	explicit BasicInputMessage(const char* name) : Message(name)	{}
 };
 
 /**
@@ -373,7 +373,7 @@ protected:
 	 * @param name A descriptive name for the type of message. Used
 	 * mainly for debugging purposes.
 	 */
-	BasicOutputMessage(const char* name) : Message(name)	{}
+	explicit BasicOutputMessage(const char* name) : Message(name)	{}
 };
 
 /**
diff --git a/src/threading/formatters/JSON.h b/src/threading/formatters/JSON.h
index 04209fbde9..4984f74067 100644
--- a/src/threading/formatters/JSON.h
+++ b/src/threading/formatters/JSON.h
@@ -20,12 +20,12 @@ public:
 		};
 
 	JSON(threading::MsgThread* t, TimeFormat tf);
-	virtual ~JSON();
+	~JSON() override;
 
-	virtual bool Describe(ODesc* desc, threading::Value* val, const string& name = "") const;
-	virtual bool Describe(ODesc* desc, int num_fields, const threading::Field* const * fields,
-	                      threading::Value** vals) const;
-	virtual threading::Value* ParseValue(const string& s, const string& name, TypeTag type, TypeTag subtype = TYPE_ERROR) const;
+	bool Describe(ODesc* desc, threading::Value* val, const string& name = "") const override;
+	bool Describe(ODesc* desc, int num_fields, const threading::Field* const * fields,
+	                      threading::Value** vals) const override;
+	threading::Value* ParseValue(const string& s, const string& name, TypeTag type, TypeTag subtype = TYPE_ERROR) const override;
 
 	void SurroundingBraces(bool use_braces);
 
diff --git a/src/util.h b/src/util.h
index 5dc2484319..05305dd55c 100644
--- a/src/util.h
+++ b/src/util.h
@@ -275,8 +275,8 @@ protected:
 class SafeDirname : public SafePathOp {
 public:
 
-	SafeDirname(const char* path, bool error_aborts = true);
-	SafeDirname(const std::string& path, bool error_aborts = true);
+	explicit SafeDirname(const char* path, bool error_aborts = true);
+	explicit SafeDirname(const std::string& path, bool error_aborts = true);
 
 private:
 
@@ -286,8 +286,8 @@ private:
 class SafeBasename : public SafePathOp {
 public:
 
-	SafeBasename(const char* path, bool error_aborts = true);
-	SafeBasename(const std::string& path, bool error_aborts = true);
+	explicit SafeBasename(const char* path, bool error_aborts = true);
+	explicit SafeBasename(const std::string& path, bool error_aborts = true);
 
 private: