Hi,
I’m writing a protocol analyzer for a proprietary protocol in spicy.
I want to perform the following actions:
Skip over some bytes in the stream
Then pass the stream to some zeek analyzer using zeek::protocol_data_in() (I get the analyzer
handle using protocol_handle_get_or_create() )
Close the handle from step 2 (using protocol_handle_close(), skip over more bytes.
Then pass the reamining stream again to a new analyzer instance (That is the same analyzer
type from step 2).
For some reason, even after closing the analyzer handle in step 3 and opening a new one in step 4, it seems that this zeek analyzer is the same instance. This is a problem because I need the 2nd analyzer to start from a fresh state.
What is the correct way to instantiate a new analyzer and add it to the analyzer tree in spicy?
Do you have any code I could try to see this? How did you determine it’s going into separate instances?
I have just tried to reproduce the effect but everything seems to work fine for me. Below is what I have tried, adapting one of the existing tests we have (the pcap trace is from those tests, coming with the Zeek source code; and the last command needs a Zeek debug build to produce the debug.log.).
Would you mind sketching what lead to this issue? That information might be helpful for anybody else running into the same problem in the future, or for us to figure out whether there is a sharp edge which should be taken off. Thanks!