BinPAC analyzer name

Hi there,

I wrote a new analyzer with BinPAC for a protocol named 'AMS'.
Somehow when I create the analyzer via the binpac python script and name the analyzer 'AMS' or 'ams', the analyzer won't work. When I name it 'TEST' or 'test', it works fine (same protocol specification, C++ Code, etc.)

Is there a name convention for new analyzer? Or does anyone know, why BinPAC/Bro won't accept the name 'ams'?

Thank you!

By don't work - do you mean that it doesn't compile? Or does it not get
any traffic? Or does it not raise events?



thanks for your reply.

"Don't work" means that it doesn't raise any event nor executes the (C++) code in the analyser.pac file. It's like it can't read the traffic or something.

Like I said, when I name it Test or PROTO-AMS or something like that, it works fine.


Interesting, I am not really aware of any reason why just using AMS should
not work.

Do you appen to have your code up on github (or somewhere else)? Then I
could take a look.

If you want to investigate for a bit yourself, build bro with
--enable-debug, start it with -B dpd and look at debug.log. There you
should see if data is sent to your analyzer - that might already give you
pointers if something is going wrong at/before/after this step.


Well, I tested this behavior with the “standard code” generated by the binpac python script. I named one analyzer Test and the other AMS.

Both have the same PDU record type (except for the name of course)

type NAME_PDU(is_orig: bool) = record {
data: bytestring &restofdata;
} &byteorder=bigendian;

and the same analyzer.pac (except for the name again) with the same “proc” function:

function proc_NAME_message(msg: NAME_PDU) : bool

std::cout << “Name PDU” << endl; # for debugging

Both analyzers are enabled (checked it with -B dpd and -NN)

When I run it with some .pcap file, I only get the “Test PDU” output. Tested it with several .pcap files, everytime the same result.


Hmm. Could be a capitalization issue? binpac_quickstart does do some
uppercasing/lowercasing in a couple of the templates. For example:

Dane Wullen <> writes:

function proc_NAME_message(msg: NAME_PDU) : bool
     std::cout << "Name PDU" << endl; # for debugging

NAME here will always be lowercase (since that matches the naming scheme
for events).

I poked around with this a bit, and couldn't duplicate it. Can you put
the contents of src/analyzer/protocol/ams somewhere I could see it?




sorry, I was kind of busy the last days and couldn't answer. <-- all .pac files <- all .CC and .h files

This is the binPAC code. Like I said, only the standard code, untouched (except the std::cout line).
The same code with Test instead of AMS works fine. I don't know, maybe I'm doing something wrong, I've tested it on 3 VMs and on a Raspberry Pi, but the result are always the same.