# Implementing new layer 2 Protocol

**URL:** <https://community.zeek.org/t/implementing-new-layer-2-protocol/3800>\
**Category:** Zeek\
**Created:** [August 31, 2015, 7:20am UTC](https://community.zeek.org/t/implementing-new-layer-2-protocol/3800 "2015-08-31T07:20:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![j2om1350](https://avatars.discourse-cdn.com/v4/letter/j/b5ac83/32.png) [@j2om1350](https://community.zeek.org/u/j2om1350)\
**Post date:** [August 31, 2015, 7:20am UTC](https://community.zeek.org/t/implementing-new-layer-2-protocol/3800/1 "2015-08-31T07:20:44Z")

</div>

Hi all,

My goal is to integrate a new protocol analyzer in Bro. This protocol  
(PROFINET dyscovery and Basic Configuration Protocol) is working on layer  
2. My question is, are there special considerations to get at the data of  
the layer 2? My colleague has tried creating an analyzer by following your  
instructions for coding an analyzer by binpac. Before he went on vacation,  
he told me, he could access data with binpac of layer 3 but not of layer  
2? Is that correct? If so does it work with the new binpac ++? Any pieces  
of advice or suggestions how to get started would be greatly appreciated.

Kind regards

Marcel Odenwald

---

<div class="post-metadata">

**Author:** ![Pratik\_Inamdar1](https://avatars.discourse-cdn.com/v4/letter/p/a88e4f/32.png) [@Pratik\_Inamdar1](https://community.zeek.org/u/Pratik_Inamdar1)\
**Post date:** [March 9, 2016, 7:17am UTC](https://community.zeek.org/t/implementing-new-layer-2-protocol/3800/2 "2016-03-09T07:17:12Z")

</div>

\<j2om1350 \<at\> unibw.de\> writes:

> Hi all,
> 
> My goal is to integrate a new protocol analyzer in Bro. This protocol  
> (PROFINET dyscovery and Basic Configuration Protocol) is working on

layer

> 2. My question is, are there special considerations to get at the data

of

> the layer 2? My colleague has tried creating an analyzer by following

your

> instructions for coding an analyzer by binpac. Before he went on

vacation,

> he told me, he could access data with binpac of layer 3 but not of

layer

> 2? Is that correct? If so does it work with the new binpac ++? Any

pieces

> of advice or suggestions how to get started would be greatly

appreciated.

> Kind regards
> 
> Marcel Odenwald
> 
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_  
> Bro mailing list  
> bro \<at\> bro-ids.org  
> [mailman.icsi.berkeley.edu Mailing Lists](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro)

Hi,

I am facing a similar issue. I am trying to write analyzer for wifi  
protocol. I found some pointers, may be we can discuss them.

Thanks,  
Pratik

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/implementing-new-layer-2-protocol/3800/3 "2022-05-06T15:43:01Z")

</div>