# initial buffer length

**URL:** <https://community.zeek.org/t/initial-buffer-length/3627>\
**Category:** Zeek\
**Created:** [May 27, 2015, 3:02pm UTC](https://community.zeek.org/t/initial-buffer-length/3627 "2015-05-27T15:02:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\
**Post date:** [May 27, 2015, 3:02pm UTC](https://community.zeek.org/t/initial-buffer-length/3627/1 "2015-05-27T15:02:53Z")

</div>

Hi Abdelkarim,

In the myproto\_Header, do you have some definitions of records before msgSize (whose length is not explicitly specified)? If that is the case, BinPac cannot decide the initial length in order to locate msgSize.

You may refer the DNP3 analyzer that I wrote in a similar way.

type Header\_Block = record {  
start: uint16 &check(start == 0x0564);  
len: uint8;  
ctrl: uint8;  
dest\_addr: uint16;  
src\_addr: uint16;  
} &byteorder = littleendian;

type DNP3\_Request = record {  
addin\_header: Header\_Block; ## added by Hui Lin in Bro code  
…  
} &byteorder = bigendian

---

<div class="post-metadata">

**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\
**Post date:** [May 28, 2015, 3:21pm UTC](https://community.zeek.org/t/initial-buffer-length/3627/2 "2015-05-28T15:21:51Z")

</div>

HI Abdelkarim,

Probably you should try to use the basic data type such as using int for “type” and “chunk” instead of using the bytestring (even with the length defined). I remember that the bytestring did not work for my case either. I don’t remember the reason in details now, but I remember that it is related to how Binpac compiler is implemented.

Best,

Hui Lin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/initial-buffer-length/3627/3 "2022-05-06T15:42:43Z")

</div>