# information exchange between binpac and analyzer **URL:** \ **Category:** Zeek\ **Created:** [April 15, 2014, 12:53pm UTC](https://community.zeek.org/t/information-exchange-between-binpac-and-analyzer/3066 "2014-04-15T12:53:27Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Prateek\_Gupta](https://avatars.discourse-cdn.com/v4/letter/p/f17d59/32.png) [@Prateek\_Gupta](https://community.zeek.org/u/Prateek_Gupta)\ **Post date:** [April 15, 2014, 12:53pm UTC](https://community.zeek.org/t/information-exchange-between-binpac-and-analyzer/3066/1 "2014-04-15T12:53:27Z")
Hello, I am working on Bro-IDS as my academic project and want some information. I want to know what are the data structures implemented in analyzer and binpac and how are these data structures passed between them. Its urgent. Thank you. ---
**Author:** ![Vlad\_Grigorescu2](https://avatars.discourse-cdn.com/v4/letter/v/c4cdca/32.png) [@Vlad\_Grigorescu2](https://community.zeek.org/u/Vlad_Grigorescu2)\ **Post date:** [April 15, 2014, 1:10pm UTC](https://community.zeek.org/t/information-exchange-between-binpac-and-analyzer/3066/2 "2014-04-15T13:10:54Z")
I don't understand the question. BinPAC is a compiler. It takes one or more .pac files, and compiles them to a .cc and .h file. Those then get compiled with the rest of Bro. You can look at these .cc and .h files when you build Bro - build/src/analyzer/protocol/ssl/ssl\_pac.cc, for example. Data structures will be in those files. Have you seen the documentation? [http://www.icir.org/vern/papers/binpac.IMC06.pdf](http://www.icir.org/vern/papers/binpac.IMC06.pdf) [https://www.bro.org/download/README.binpac.html](https://www.bro.org/download/README.binpac.html) [http://www.bro.org/development/howtos/binpac-sample-analyzer.html](http://www.bro.org/development/howtos/binpac-sample-analyzer.html) Let us know if you have a specific question.   --Vlad ---
**Author:** ![Prateek\_Gupta](https://avatars.discourse-cdn.com/v4/letter/p/f17d59/32.png) [@Prateek\_Gupta](https://community.zeek.org/u/Prateek_Gupta)\ **Post date:** [April 15, 2014, 1:49pm UTC](https://community.zeek.org/t/information-exchange-between-binpac-and-analyzer/3066/3 "2014-04-15T13:49:59Z")
Hello Vlad, Thank you for your reply. Though I framed the question completely wrong, yet your answer served almost all my queries. I have another doubt and please correct my mistakes. The C++ code is generated of the .pac files by the binpac in the build. After “make” and “make install”, is this the final analyzer ? What do the .cc files along with the .pac files in the analyzer have as content if I intend to write a custom protocol? As binpac calls the event function for the protocols when a particular “type” is detected, are those event functions present in these .cc files? Are the data structures present in these binpac compiled .cc files used for information exchange? Thank you. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/information-exchange-between-binpac-and-analyzer/3066/4 "2022-05-06T15:41:42Z")