# BinPac - Many repeated messages in the same packet

**URL:** <https://community.zeek.org/t/binpac-many-repeated-messages-in-the-same-packet/5075>\
**Category:** Development\
**Tags:** development\
**Created:** [October 25, 2017, 11:16pm UTC](https://community.zeek.org/t/binpac-many-repeated-messages-in-the-same-packet/5075 "2017-10-25T23:16:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aaron\_Eppert](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@Aaron\_Eppert](https://community.zeek.org/u/Aaron_Eppert)\
**Post date:** [October 25, 2017, 11:16pm UTC](https://community.zeek.org/t/binpac-many-repeated-messages-in-the-same-packet/5075/1 "2017-10-25T23:16:52Z")

</div>

I am running into an implementation issue with BinPac and would hope  
to find a few pointers.

I have a protocol that loads a given TCP packet with as many publish  
messages as possible in a worst case scenario - often it just has a  
single message, but it is not guaranteed. When a publish message  
contains more than one subsequent message, there is not an indicator  
that another message follows.

The packet looks, generally like this:

---

<div class="post-metadata">

**Author:** ![Fernandez\_Mark\_I](https://avatars.discourse-cdn.com/v4/letter/f/e274bd/32.png) [@Fernandez\_Mark\_I](https://community.zeek.org/u/Fernandez_Mark_I)\
**Post date:** [October 26, 2017, 10:55am UTC](https://community.zeek.org/t/binpac-many-repeated-messages-in-the-same-packet/5075/2 "2017-10-26T10:55:00Z")

</div>

Aaron,

> > I have a protocol that loads a given TCP packet with as many publish  
> > messages as possible in a worst case scenario - often it just has a  
> > single message, but it is not guaranteed. When a publish message  
> > contains more than one subsequent message, there is not an indicator  
> > that another message follows.

Perhaps try something like this:

type SPROTO\_messages = SPROTO\_message  
&until($input.length() == 0); # or some appropriate terminating condition

Type SPROTO\_message = record {  
&nbsp;&nbsp;&nbsp;&nbsp;thdr : uint8;  
&nbsp;&nbsp;&nbsp;&nbsp;hdrlen : uint8;  
&nbsp;&nbsp;&nbsp;&nbsp;variable\_header : case msg\_type of {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SPROTO\_CONNECT -\> connect\_packet : SPROTO\_connect(hdrlen);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SPROTO\_SUBSCRIBE -\> subscribe\_packet : SPROTO\_subscribe(hdrlen);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SPROTO\_SUBACK -\> suback\_packet : SPROTO\_suback(hdrlen);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SPROTO\_PUBLISH -\> publish\_packet : SPROTO\_publish(hdrlen);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SPROTO\_UNSUBSCRIBE -\> unsubscribe\_packet : SPROTO\_unsubscribe(hdrlen);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;default -\> none : empty;  
&nbsp;&nbsp;&nbsp;&nbsp;};  
} &let {  
&nbsp;&nbsp;&nbsp;&nbsp;msg\_type : uint8 = (thdr \>\> 4);  
};

Mark

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/binpac-many-repeated-messages-in-the-same-packet/5075/3 "2022-05-06T15:45:22Z")

</div>