# Hui Lin\_Confusion in Dynamic Protocol Detection **URL:** \ **Category:** Development\ **Tags:** development\ **Created:** [August 5, 2011, 5:19am UTC](https://community.zeek.org/t/hui-lin-confusion-in-dynamic-protocol-detection/1964 "2011-08-05T05:19:12Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\ **Post date:** [August 5, 2011, 5:19am UTC](https://community.zeek.org/t/hui-lin-confusion-in-dynamic-protocol-detection/1964/1 "2011-08-05T05:19:12Z")
Hi, When I read [http://www.bro-ids.org/development/dpd.html](http://www.bro-ids.org/development/dpd.html) about DPD, I always have confusion in its wording. 1. From the “Class Layout” picture, every analyzer is derived from class “Analyzer”, but the wording also says that “The root node must always be of type `TransportLayerAnalyzer`.” So which one is the real root in the Bro’s code. yzer directly derived by “Analyzer”) are located in this analyzer tree structure. 2. In the section “Determining Analyzer Activation”, I am also confused about the method to activate the analyzer on all connections. Foo\_Analyzer is derived TCP\_ApplicationAnalyzer, but why this Foo\_Analyzer is added as the child of TCP\_Analyzer. tcp-\>AddChildAnalyzer(new Foo\_Analyzer(conn)); So what is the differences between TCP\_ApplicationAnalyzer and TCP\_Analyzer. Hui Lin ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [August 8, 2011, 4:39am UTC](https://community.zeek.org/t/hui-lin-confusion-in-dynamic-protocol-detection/1964/2 "2011-08-08T04:39:26Z")
> 1. From the "Class Layout" picture, every analyzer is derived from class > "Analyzer", but the wording also says that "The root node must always be of > type TransportLayerAnalyzer." So which one is the real root in the Bro's > code. yzer directly derived by "Analyzer") are located in this analyzer tree > structure. There are two different trees here: (1) the class hierarchy, which is shown on the Wiki page and in which the Analyzer class is the root; (2) the tree of analyzer \*instances\* instantiated for each connection at runtime. In the latter, a TransportLayerAnalyzer instance must be the root. The paper may help: [http://www.icir.org/robin/papers/usenix06.pdf](http://www.icir.org/robin/papers/usenix06.pdf) > So what is the differences between TCP\_ApplicationAnalyzer and > TCP\_Analyzer. The TCP\_Analyzer analyzes TCP itself, while a TCP\_ApplicationAnalyzer analyzes an application-layer protocol that's running on top of TCP. The former passes payload data on to the latter that's why they are linked in the analyzer tree. Robin ---
**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\ **Post date:** [August 8, 2011, 4:56am UTC](https://community.zeek.org/t/hui-lin-confusion-in-dynamic-protocol-detection/1964/3 "2011-08-08T04:56:01Z")
For 1, I am OK. For 2, I still confused, please see the inline comment. > > 1. From the “Class Layout” picture, every analyzer is derived from class > > “Analyzer”, but the wording also says that “The root node must always be of > > type TransportLayerAnalyzer.” So which one is the real root in the Bro’s > > code. yzer directly derived by “Analyzer”) are located in this analyzer tree > > structure. > > There are two different trees here: (1) the class hierarchy, which is > shown on the Wiki page and in which the Analyzer class is the root; > (2) the tree of analyzer _instances_ instantiated for each connection > at runtime. In the latter, a TransportLayerAnalyzer instance must be > the root. The paper may help: > [http://www.icir.org/robin/papers/usenix06.pdf](http://www.icir.org/robin/papers/usenix06.pdf) > > > So what is the differences between TCP\_ApplicationAnalyzer and > > TCP\_Analyzer. > > The TCP\_Analyzer analyzes TCP itself, while a TCP\_ApplicationAnalyzer > analyzes an application-layer protocol that’s running on top of TCP. > The former passes payload data on to the latter that’s why they are > linked in the analyzer tree. So it seems that TCP\_ApplicationAnalyzer behave like a helping interface between TCP protocol and other application-over-TCP protocol. I would also like to learn how TCP\_Analyzer passes payload to TCP\_AppliationAnalyzer in implementation. For the DNP3 protocol, I actually have to write two application level analyzer and one passes the payload to the other one to do some further parsing. I would like to refer TCP’s implementation. ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [August 8, 2011, 3:49pm UTC](https://community.zeek.org/t/hui-lin-confusion-in-dynamic-protocol-detection/1964/4 "2011-08-08T15:49:33Z")
TCP's data flow is more complex than you need (I believe) because the TCP reassembler is potentially involved too. In your case, the first analyzer would call its ForwardStream(), and the data will then show up in the second's DeliverStream() method. Robin ---
**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\ **Post date:** [August 9, 2011, 5:16am UTC](https://community.zeek.org/t/hui-lin-confusion-in-dynamic-protocol-detection/1964/5 "2011-08-09T05:16:05Z")
After checking Bro’s code (especially Analyzer.h, Analyzer.cc), I think the logic is like this (please point out if I am wrong): TCP\_Analyzer will parse the TCP protocol and extract the palyload (input to application level protocol analyzer), this payload will be passed up to Analyzer class (how to pass is not clear to me). After Analyzer knows this stream of TCP payload and this is the input of the ForwardStream. ForwardStream then call Analyzer’s children to use their own DeliverStream. In each DeliverStream implementation, the Binpac Conn function is used to parse the stream. So in my opinion, from Analyzer, TCP\_ApplicationAnalyzer to the application-level analyzer, the stream actually does not change. But for my situation, I have two application-level protocols, p1 and p2. p1 derive from TCP\_ApplicationAnalyzer and p1 needs to parse and reconstruct stream from TCP level, not directly pass the stream to p2. So I think what I can do is to let p2 derives from p1. And then define a event handler in p1 to reconstruct stream as it parse its protocol, in this event handler, we can have the reconstructed stream and use it as the input to call ForwardStream of p1. p2 still defines the DeliverStream as usual, and in this way, p2’s protocol analyzer should be able get those reconstructed stream. Best, ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/hui-lin-confusion-in-dynamic-protocol-detection/1964/6 "2022-05-06T15:39:43Z")