# exercising binpac++/spicy parsers

**URL:** <https://community.zeek.org/t/exercising-binpac-spicy-parsers/3516>\
**Category:** Zeek\
**Created:** [March 13, 2015, 11:39am UTC](https://community.zeek.org/t/exercising-binpac-spicy-parsers/3516 "2015-03-13T11:39:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Troy\_Jordan](https://avatars.discourse-cdn.com/v4/letter/t/ecae2f/32.png) [@Troy\_Jordan](https://community.zeek.org/u/Troy_Jordan)\
**Post date:** [March 13, 2015, 11:39am UTC](https://community.zeek.org/t/exercising-binpac-spicy-parsers/3516/1 "2015-03-13T11:39:47Z")

</div>

Hello,

There are some hilti-based parsers in the Bro docker image. When I run  
the pcaps for BACnet (/opt/hilti/bro/tests/Traces/bacnet/\*.pcap) through  
Bro (eg bro -r NPDU.pcap) , no event logs are produced in  
/usr/local/bro/logs).

How do I integrate these parsers into Bro?

- Troy

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [March 13, 2015, 2:39pm UTC](https://community.zeek.org/t/exercising-binpac-spicy-parsers/3516/2 "2015-03-13T14:39:19Z")

</div>

Hello Troy,

> There are some hilti-based parsers in the Bro docker image. When I run  
> the pcaps for BACnet (/opt/hilti/bro/tests/Traces/bacnet/\*.pcap) through  
> Bro (eg bro -r NPDU.pcap) , no event logs are produced in  
> /usr/local/bro/logs).

You have to load the applicable scripts and pac files for Bro to be able  
to parse these protocols. Which files you have to load depends a bit on  
the protocol. The easiest way is to look at the tests that should be there  
for each of the protocols that is to look into the tests directory in  
hilti/bro/tests. In there, pac2/bacnet/npdu\_nlmessages.bro shows that to  
parse the NPDUs, it loads bacnet.evt and bacnet.bro out of the hilti  
distribution and then defines a few custom events for output.

Generally, none of the spicy parsers come with the Bro scripts to generate  
log output -- the parsers just create events. For some of the parsers  
replacing protocols (like DNS or HTTP), the events might be similar enough  
to the events emitted by the binpac parsers to already generate logs. For  
all new protocols implemented by spicy, you would first have to create  
such scripts.

I hope that helps,  
Johanna

---

<div class="post-metadata">

**Author:** ![Troy\_Jordan](https://avatars.discourse-cdn.com/v4/letter/t/ecae2f/32.png) [@Troy\_Jordan](https://community.zeek.org/u/Troy_Jordan)\
**Post date:** [March 13, 2015, 11:40pm UTC](https://community.zeek.org/t/exercising-binpac-spicy-parsers/3516/3 "2015-03-13T23:40:32Z")

</div>

Johanna, that does help, thank you.

Was BACnet used simply as a test for spicy, or perhaps are there plans  
to develop it further?

- Troy

---

<div class="post-metadata">

**Author:** ![Troy\_Jordan](https://avatars.discourse-cdn.com/v4/letter/t/ecae2f/32.png) [@Troy\_Jordan](https://community.zeek.org/u/Troy_Jordan)\
**Post date:** [November 8, 2015, 9:12pm UTC](https://community.zeek.org/t/exercising-binpac-spicy-parsers/3516/4 "2015-11-08T21:12:24Z")

</div>

(reviving this old thread)

Is the method for generating log output the same with spicy parsers as  
it is for binpac parsers? Would the code to do so reside in .bro file?

- Troy

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/exercising-binpac-spicy-parsers/3516/5 "2022-05-06T15:42:31Z")

</div>