# Help creating new analyzer **URL:** \ **Category:** Development\ **Tags:** development\ **Created:** [April 15, 2011, 3:57am UTC](https://community.zeek.org/t/help-creating-new-analyzer/1857 "2011-04-15T03:57:51Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Kristin\_Stephens](https://avatars.discourse-cdn.com/v4/letter/k/45deac/32.png) [@Kristin\_Stephens](https://community.zeek.org/u/Kristin_Stephens)\ **Post date:** [April 15, 2011, 3:57am UTC](https://community.zeek.org/t/help-creating-new-analyzer/1857/1 "2011-04-15T03:57:51Z")
Hi Everyone, I’m create a new analyzer for Bro and am currently just trying to create a skeleton that does nothing, but compiles. I’m currently stuck at a compile error that I don’t really know the meaning of “cannot handle incremental input” I basically copied another analyzer and stripped out everything but the basics. The only reference I could find to incremental input on the wiki was using flowunit versus datagram in the \*-analyzer.pac file. But I am using flowunit there. Any help would be much appreciated, Kristin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 15, 2011, 12:31pm UTC](https://community.zeek.org/t/help-creating-new-analyzer/1857/2 "2011-04-15T12:31:12Z")
Could you send along your .pac files? It usually has to do with a unit where you are trying to have a bytestring parsed until &endofdata, but the unit or the parent unit doesn't have a &length applied (I think).   .Seth ---
**Author:** ![Kristin\_Stephens](https://avatars.discourse-cdn.com/v4/letter/k/45deac/32.png) [@Kristin\_Stephens](https://community.zeek.org/u/Kristin_Stephens)\ **Post date:** [April 15, 2011, 6:37pm UTC](https://community.zeek.org/t/help-creating-new-analyzer/1857/3 "2011-04-15T18:37:32Z")
Attached are my .pac files. There’s close to nothing in them though. I don’t use &endofdata anywhere. Kristin [bgp.pac](https://community.zeek.org/uploads/short-url/9pkL3tQTKOZKZjoU2hyzmalRqaF.pac) (216 Bytes) [bgp-analyzer.pac](https://community.zeek.org/uploads/short-url/gyaoZsuWf9IOOsSEfRNI11ZajWg.pac) (255 Bytes) [bgp-protocol.pac](https://community.zeek.org/uploads/short-url/dVOGCMnnTkNtLZJQ0pZksEbeops.pac) (215 Bytes) ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 15, 2011, 6:56pm UTC](https://community.zeek.org/t/help-creating-new-analyzer/1857/4 "2011-04-15T18:56:22Z")
You are naming a field "length" in bgp-protocol.pac. That token name is used for the unit length so you are essentially saying that your entire BGP\_Message unit is the size of that &length field. Just change the name. 🙂   .Seth ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 15, 2011, 6:57pm UTC](https://community.zeek.org/t/help-creating-new-analyzer/1857/5 "2011-04-15T18:57:52Z")
Oops, nevermind. My answer just a second ago is wrong. I'll look around a bit more.   .Seth ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 15, 2011, 7:18pm UTC](https://community.zeek.org/t/help-creating-new-analyzer/1857/6 "2011-04-15T19:18:18Z")
I think you found a bug in binpac. I've noticed that bytestrings aren't handled correctly everywhere as you would expect if they have a static length (as it seems to be happening here). In bgp-protocol.bro, if you change...         marker: bytestring &length=16; to         marker: uint8[16]; that will fix a piece of the problem, but you also need to define the total length of your outer containing unit (BGP\_Message). The following code will do it. type BGP\_Message = record {         marker: uint8[16];         length: uint16;         type: uint8;         msg: bytestring &restofdata; } &byteorder = bigendian &length=length; With that change to the BGP\_Message, it compiles fine for me. Looking forward to a BGP analyzer! 🙂   .Seth ---
**Author:** ![Kristin\_Stephens](https://avatars.discourse-cdn.com/v4/letter/k/45deac/32.png) [@Kristin\_Stephens](https://community.zeek.org/u/Kristin_Stephens)\ **Post date:** [April 15, 2011, 10:18pm UTC](https://community.zeek.org/t/help-creating-new-analyzer/1857/7 "2011-04-15T22:18:53Z")
Just for the sake of my own understanding. The changes you made above say the exact same thing I had originally except they don't use the &length attribute. And normally it would work except there is a bug with bytestring and setting its &length property? Kristin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 15, 2011, 11:57pm UTC](https://community.zeek.org/t/help-creating-new-analyzer/1857/8 "2011-04-15T23:57:19Z")
> Just for the sake of my own understanding. The changes you made above > say the exact same thing I had originally except they don't use the > &length attribute. Sort of. When you go to use the marker value you will be receiving an array of 8bit ints instead of a bytestring value, but you can just write you code around that (assuming you are even using the marker value). The main thing is that I set a length on the whole record. > And normally it would work except there is a bug > with bytestring and setting its &length property? The bug is only prevalent in certain cases because binpac has to know the full size of the unit before it hits a dynamically sized field (if I understand it correctly) but for some reason even if you set a static size for a bytestring it thinks that's a dynamically sized field still which is why I changed it to a 16-long uint8 array.   Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/help-creating-new-analyzer/1857/9 "2022-05-06T15:39:32Z")