# Digging through Source Code **URL:** \ **Category:** Zeek\ **Created:** [June 20, 2017, 8:42pm UTC](https://community.zeek.org/t/digging-through-source-code/4910 "2017-06-20T20:42:35Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Weasel\_Gary\_W\_CIV\_DI](https://avatars.discourse-cdn.com/v4/letter/w/c77e96/32.png) [@Weasel\_Gary\_W\_CIV\_DI](https://community.zeek.org/u/Weasel_Gary_W_CIV_DI)\ **Post date:** [June 20, 2017, 8:42pm UTC](https://community.zeek.org/t/digging-through-source-code/4910/1 "2017-06-20T20:42:35Z")
Yes, but there's something that's still stumping me. Looking at line 70 from [https://github.com/bro/bro/blob/master/src/analyzer/protocol/krb/krb-analyzer.pac](https://github.com/bro/bro/blob/master/src/analyzer/protocol/krb/krb-analyzer.pac) case 8:         if ( element-\>data()-\>etype()-\>data()-\>size() )                 rv-\>Assign(11, proc\_cipher\_list(element-\>data()-\>etype())); Following the breadcrumb trail in the if statement here...         element is type KRB\_REQ\_Arg (defined - [https://github.com/bro/bro/blob/master/src/analyzer/protocol/krb/krb-protocol.pac](https://github.com/bro/bro/blob/master/src/analyzer/protocol/krb/krb-protocol.pac)) -\> data is type KRB\_REQ\_Arg\_Data (defined - [https://github.com/bro/bro/blob/master/src/analyzer/protocol/krb/krb-protocol.pac](https://github.com/bro/bro/blob/master/src/analyzer/protocol/krb/krb-protocol.pac)) -\> etype is type Array (defined - [https://github.com/bro/bro/blob/master/src/analyzer/protocol/asn1/asn1.pac](https://github.com/bro/bro/blob/master/src/analyzer/protocol/asn1/asn1.pac)) -\> data is type ASN1Encoding (defined - [https://github.com/bro/bro/blob/master/src/analyzer/protocol/asn1/asn1.pac](https://github.com/bro/bro/blob/master/src/analyzer/protocol/asn1/asn1.pac)) -\> size is type ? Following this line of thought, I'm a little confused by what "size()" is supposed to mean here, since it's not an attribute. I can infer that it's simply returning the size of the record, but I don't have any information as to how or where that would be defined. I've also tried looking through the source of BinPAC ([https://www.bro.org/sphinx/components/binpac/README.html](https://www.bro.org/sphinx/components/binpac/README.html)) but have come up empty so far. I have a sample of kerberos pcap that populates the msg$pa\_data$encryption\_type vector (from event krb\_tgs\_request), so I know that the aforementioned if statement is returning true - - but the other two vectors "host\_addrs" and "additional"tickets" (that from documentation seem to imply they're parallel with the encryption\_type vector) come up as \. This made me question that maybe there was something wrong with the code that was causing it to miss the host\_addr and ticket data, I clearly find this data in my pcap sample under padata. This is my current theory anyway, and wanted to see if I'm making a bad assumption somewhere or if someone can shed light on what's going on here. ---
**Author:** ![Daniel\_Guerra](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Daniel\_Guerra](https://community.zeek.org/u/Daniel_Guerra)\ **Post date:** [June 20, 2017, 9:43pm UTC](https://community.zeek.org/t/digging-through-source-code/4910/2 "2017-06-20T21:43:36Z")
Talking about ASN1. Would bro be able to read ETSI standard files ? ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [June 22, 2017, 7:42pm UTC](https://community.zeek.org/t/digging-through-source-code/4910/3 "2017-06-22T19:42:08Z")
Actually, data is of type ASN1Encoding[] - so it is an array; size returns the size of that array (i.e. the number of array elements). I hope that helps, Johanna ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [June 22, 2017, 7:45pm UTC](https://community.zeek.org/t/digging-through-source-code/4910/4 "2017-06-22T19:45:25Z")
I don't know ETSI standard files, but just assuming they are some kind of ASN.1 data: While Bro has a bit of ASN.1 parsing capability (meaning that there is a binpac definition for parts of ASN.1), the implementation is limited to a small subset of ASN.1. Furthermore it is no generic parser - one still has to implement the actual parsing logic for the specific ASN.1 data on top of the existing primitives. So - no, not currently. Johanna ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/digging-through-source-code/4910/5 "2022-05-06T15:45:04Z")