# Hui Lin\_Binpac: handle incremental input for flowunit **URL:** \ **Category:** Development\ **Tags:** development\ **Created:** [July 21, 2011, 4:41am UTC](https://community.zeek.org/t/hui-lin-binpac-handle-incremental-input-for-flowunit/1935 "2011-07-21T04:41:12Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\ **Post date:** [July 21, 2011, 4:41am UTC](https://community.zeek.org/t/hui-lin-binpac-handle-incremental-input-for-flowunit/1935/1 "2011-07-21T04:41:12Z")
HI, When I define flowunit data for flow, I am bothered by the not support incremental input. I have searched this error and found a mail from Seth. It seems that flowunit data has to be clearly set the &length. My situation is something like follows type XXX\_Request = record { header: Header; data: case header.function\_code of { x → request\_type1: Type1; x → request\_type2: Type2; … }; } &length = …; XXX\_Request is the flowunit data. My problem is that after header is parsed, I still don’t know the length of the whole XXX\_Request data unit. The function\_code from the header will define what data type follows the header and different data type have different length. So I am wondering what I can do in this situation to set the proper value of length of the XXX\_Request. Or flowunit is not supporting this situation, I have to use the datagram？ Best, Hui ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [July 21, 2011, 4:56am UTC](https://community.zeek.org/t/hui-lin-binpac-handle-incremental-input-for-flowunit/1935/2 "2011-07-21T04:56:35Z")
Presumably this is for the DNP3 protocol? There isn't any framing around the request with the length? Are they framing it to the packet perhaps? (I'm running into sort of similar trouble with the SSL analyzer and binpac doesn't let you frame to the packets). I don't think you can use datagram if the protocol you're working on is TCP since the packets could be fragmented or out of order. I'd love to be proven wrong though....   .Seth ---
**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\ **Post date:** [July 21, 2011, 5:18am UTC](https://community.zeek.org/t/hui-lin-binpac-handle-incremental-input-for-flowunit/1935/3 "2011-07-21T05:18:34Z")
It is the DNP3 protocol. I kind of refer to the modbus protocol that shared from Dina. In modbus, the header contain the length field, so it is straightforward to set the length of the flowunit. But DNP3 does not contain such field to directly indicate the length of the application level fragment. The structure is kind of more complex. Some request will contain addition headers and objects, so you can only know the length of the whole fragment when you parse them all. Or at least parse this additional header (but there is also no length field in this additional header). I don’t quite follow what do you mean “framing it to the packet”. Any further suggestion? ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [July 21, 2011, 11:51am UTC](https://community.zeek.org/t/hui-lin-binpac-handle-incremental-input-for-flowunit/1935/4 "2011-07-21T11:51:48Z")
I just mean using the packet length as the length of the request or response. If that's how the protocol works and if binpac supported it (a lot of "if"s), that would provide you the way to give a length to the top parse unit to avoid the incremental parsing error. Maybe someone else has a suggestion? I'm unfortunately out of ideas.   .Seth ---
**Author:** ![Adam\_J\_Slagell](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@Adam\_J\_Slagell](https://community.zeek.org/u/Adam_J_Slagell)\ **Post date:** [July 21, 2011, 9:05pm UTC](https://community.zeek.org/t/hui-lin-binpac-handle-incremental-input-for-flowunit/1935/5 "2011-07-21T21:05:39Z")
Obviously, modbus-tcp was on tcp, but is DNP3? ---
**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\ **Post date:** [July 22, 2011, 4:01am UTC](https://community.zeek.org/t/hui-lin-binpac-handle-incremental-input-for-flowunit/1935/6 "2011-07-22T04:01:51Z")
DNP3 protocol do include some support for what it calls Pseudo Transport Layer. And it also mentions that some company would like to see DNP3 can be put on TCP/IP. So I would like to try use flowunit to implement DNP3 protocol. ---
**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\ **Post date:** [July 22, 2011, 4:28am UTC](https://community.zeek.org/t/hui-lin-binpac-handle-incremental-input-for-flowunit/1935/7 "2011-07-22T04:28:46Z")
Hi Seth, Here is a piece code from SSL protocol (as you mentioned that you met the similar problem in SSL protocol) type SSLRecord(is\_orig: bool) = record { head0 : uint8; head1 : uint8; head2 : uint8; head3 : uint8; head4 : uint8; rec : RecordText(this, is\_orig) &requires(content\_type), &restofdata; } &length = length+5, &byteorder=bigendian, &let { version : int = $context.analyzer.determine\_ssl\_version(head0, head1, head2); content\_type : int = case version of { UNKNOWN\_VERSION → 0; SSLv20 → head2+300; default → head0; }; length : int = case version of { UNKNOWN\_VERSION → 0; SSLv20 → (((head0 & 0x7f) \<\< 8) | head1) - 3; default → (head3 \<\< 8) | head4; }; }; Here the &length is set by its attribute length and length is then decided according to different situation. so I think this might be working in my case? As I can similarly set length to different value according to the function code and then use this to set the &length. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [July 22, 2011, 11:17am UTC](https://community.zeek.org/t/hui-lin-binpac-handle-incremental-input-for-flowunit/1935/8 "2011-07-22T11:17:11Z")
Yes, you should be able to do something similar to that. I can't claim to have come up with that technique either. Whoever wrote the previous binpac SSL analyzer did it, but we are currently having some trouble with that when DPD is enabled. We're trying to get it fixed for the preview though.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/hui-lin-binpac-handle-incremental-input-for-flowunit/1935/9 "2022-05-06T15:39:40Z")
Closed on May 6, 2022, 3:39pm UTC