# information between TLanallyzer and Application protocol analyzer

**URL:** <https://community.zeek.org/t/information-between-tlanallyzer-and-application-protocol-analyzer/3081>\
**Category:** Zeek\
**Created:** [April 23, 2014, 5:17pm UTC](https://community.zeek.org/t/information-between-tlanallyzer-and-application-protocol-analyzer/3081 "2014-04-23T17:17:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prateek\_Gupta](https://avatars.discourse-cdn.com/v4/letter/p/f17d59/32.png) [@Prateek\_Gupta](https://community.zeek.org/u/Prateek_Gupta)\
**Post date:** [April 23, 2014, 5:17pm UTC](https://community.zeek.org/t/information-between-tlanallyzer-and-application-protocol-analyzer/3081/1 "2014-04-23T17:17:59Z")

</div>

Hello,

I have a query. In TCP.cc , the information is trasferred to the child analyzers (i.e. application protocol analyzer) using statement  
LOOP\_OVER\_GIVEN\_ and calling NextPacket() function

but in the case of UDP I dont find any mechanism to transfer info to the application layer protocol. Do the UDP based application protocol get their own information from connection via their respective .pac analyzer? If not can you please explain in brief.

Thank you,

Prateek

---

<div class="post-metadata">

**Author:** ![Prateek\_Gupta](https://avatars.discourse-cdn.com/v4/letter/p/f17d59/32.png) [@Prateek\_Gupta](https://community.zeek.org/u/Prateek_Gupta)\
**Post date:** [April 23, 2014, 5:21pm UTC](https://community.zeek.org/t/information-between-tlanallyzer-and-application-protocol-analyzer/3081/2 "2014-04-23T17:21:24Z")

</div>

Is ForwardPacket() function supplyin the info to the child analyzer?

---

<div class="post-metadata">

**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\
**Post date:** [April 23, 2014, 6:22pm UTC](https://community.zeek.org/t/information-between-tlanallyzer-and-application-protocol-analyzer/3081/3 "2014-04-23T18:22:31Z")

</div>

Each connection starts with an analyzer tree that looks like (see analyzer::Manager::BuildInitialAnalyzerTree):

UDP: UDP\_Analyzer -\> PIA\_UDP, any analyzers registered for a well-known UDP resp port  
TCP: TCP\_Analyzer -\> PIA\_TCP, any analyzers registered for a well-known TCP resp port

The PIA\_\*, Port Independent Analysis (I think), are responsible for automatically attaching new analyzers if payload content matches provided signatures.

Children of UDP\_Analyzer which override Analyzer::DeliverPacket will start receiving packets immediately from Analyzer::ForwardPacket.

Children of TCP\_Analyzer which override Analyzer::DeliverPacket will start receiving packets immediately from (1) Analyzer::ForwardPacket if reassembly is not enabled (2) Analyzer::NextPacket if they were explicitly added as children via TCP\_Analyzer::AddChildPacketAnalyzer.

It’s more typical for children of TCP\_Analyzer to be overriding Analyzer::DeliverStream in order to receive input as reassembled TCP segments. i.e. protocols on top of TCP may choose between packet-wise and stream-wise input, but the later is more common.

- Jon

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/information-between-tlanallyzer-and-application-protocol-analyzer/3081/4 "2022-05-06T15:41:43Z")

</div>