# BinPAC analyzer name

**URL:** <https://community.zeek.org/t/binpac-analyzer-name/4474>\
**Category:** Zeek\
**Created:** [November 7, 2016, 10:56pm UTC](https://community.zeek.org/t/binpac-analyzer-name/4474 "2016-11-07T22:56:01Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![dw21](https://avatars.discourse-cdn.com/v4/letter/d/58956e/32.png) [@dw21](https://community.zeek.org/u/dw21)\
**Post date:** [November 7, 2016, 10:56pm UTC](https://community.zeek.org/t/binpac-analyzer-name/4474/1 "2016-11-07T22:56:01Z")

</div>

Hi there,

I wrote a new analyzer with BinPAC for a protocol named 'AMS'.  
Somehow when I create the analyzer via the binpac python script and name the analyzer 'AMS' or 'ams', the analyzer won't work. When I name it 'TEST' or 'test', it works fine (same protocol specification, C++ Code, etc.)

Is there a name convention for new analyzer? Or does anyone know, why BinPAC/Bro won't accept the name 'ams'?

Thank you!

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [November 28, 2016, 11:05pm UTC](https://community.zeek.org/t/binpac-analyzer-name/4474/2 "2016-11-28T23:05:55Z")

</div>

By don't work - do you mean that it doesn't compile? Or does it not get  
any traffic? Or does it not raise events?

Johanna

---

<div class="post-metadata">

**Author:** ![dw21](https://avatars.discourse-cdn.com/v4/letter/d/58956e/32.png) [@dw21](https://community.zeek.org/u/dw21)\
**Post date:** [November 28, 2016, 11:11pm UTC](https://community.zeek.org/t/binpac-analyzer-name/4474/3 "2016-11-28T23:11:00Z")

</div>

Hey,

thanks for your reply.

"Don't work" means that it doesn't raise any event nor executes the (C++) code in the analyser.pac file. It's like it can't read the traffic or something.

Like I said, when I name it Test or PROTO-AMS or something like that, it works fine.

Dane

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [November 28, 2016, 11:15pm UTC](https://community.zeek.org/t/binpac-analyzer-name/4474/4 "2016-11-28T23:15:25Z")

</div>

Interesting, I am not really aware of any reason why just using AMS should  
not work.

Do you appen to have your code up on github (or somewhere else)? Then I  
could take a look.

If you want to investigate for a bit yourself, build bro with  
--enable-debug, start it with -B dpd and look at debug.log. There you  
should see if data is sent to your analyzer - that might already give you  
pointers if something is going wrong at/before/after this step.

Johanna

---

<div class="post-metadata">

**Author:** ![dw21](https://avatars.discourse-cdn.com/v4/letter/d/58956e/32.png) [@dw21](https://community.zeek.org/u/dw21)\
**Post date:** [November 28, 2016, 11:45pm UTC](https://community.zeek.org/t/binpac-analyzer-name/4474/5 "2016-11-28T23:45:12Z")

</div>

Well, I tested this behavior with the “standard code” generated by the binpac python script. I named one analyzer Test and the other AMS.

Both have the same PDU record type (except for the name of course)

type NAME\_PDU(is\_orig: bool) = record {  
data: bytestring &restofdata;  
} &byteorder=bigendian;

and the same analyzer.pac (except for the name again) with the same “proc” function:

function proc\_NAME\_message(msg: NAME\_PDU) : bool  
…  
BifEvent::generate\_NAME\_event(…);  
std::cout \<\< “Name PDU” \<\< endl; # for debugging  
…

Both analyzers are enabled (checked it with -B dpd and -NN)

When I run it with some .pcap file, I only get the “Test PDU” output. Tested it with several .pcap files, everytime the same result.

Dane

---

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu3](https://avatars.discourse-cdn.com/v4/letter/v/dec6dc/32.png) [@Vlad\_Grigorescu3](https://community.zeek.org/u/Vlad_Grigorescu3)\
**Post date:** [December 6, 2016, 3:52pm UTC](https://community.zeek.org/t/binpac-analyzer-name/4474/6 "2016-12-06T15:52:00Z")

</div>

Hmm. Could be a capitalization issue? binpac\_quickstart does do some  
uppercasing/lowercasing in a couple of the templates. For example:

Dane Wullen \<brot212@googlemail.com\> writes:

> function proc\_NAME\_message(msg: NAME\_PDU) : bool  
> ...  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;BifEvent::generate\_NAME\_event(...);  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;std::cout \<\< "Name PDU" \<\< endl; # for debugging  
> ...

NAME here will always be lowercase (since that matches the naming scheme  
for events).

I poked around with this a bit, and couldn't duplicate it. Can you put  
the contents of src/analyzer/protocol/ams somewhere I could see it?

Thanks,

&nbsp;&nbsp;--Vlad

---

<div class="post-metadata">

**Author:** ![dw21](https://avatars.discourse-cdn.com/v4/letter/d/58956e/32.png) [@dw21](https://community.zeek.org/u/dw21)\
**Post date:** [December 17, 2016, 2:00pm UTC](https://community.zeek.org/t/binpac-analyzer-name/4474/7 "2016-12-17T14:00:46Z")

</div>

Hey,

sorry, I was kind of busy the last days and couldn't answer.

[http://pastebin.com/6Z9fykTT](http://pastebin.com/6Z9fykTT) \<-- all .pac files  
[http://pastebin.com/VBUM5CwE](http://pastebin.com/VBUM5CwE) \<- all .CC and .h files

This is the binPAC code. Like I said, only the standard code, untouched (except the std::cout line).  
The same code with Test instead of AMS works fine. I don't know, maybe I'm doing something wrong, I've tested it on 3 VMs and on a Raspberry Pi, but the result are always the same.

Thanks

Dane

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/binpac-analyzer-name/4474/8 "2022-05-06T15:44:15Z")

</div>

Closed on May 6, 2022, 3:44pm UTC