# Need a sample spicy script to detect IEC 61850

**URL:** <https://community.zeek.org/t/need-a-sample-spicy-script-to-detect-iec-61850/7095>\
**Category:** Zeek\
**Tags:** development\
**Created:** [July 22, 2023, 2:42pm UTC](https://community.zeek.org/t/need-a-sample-spicy-script-to-detect-iec-61850/7095 "2023-07-22T14:42:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\
**Post date:** [July 22, 2023, 2:42pm UTC](https://community.zeek.org/t/need-a-sample-spicy-script-to-detect-iec-61850/7095/1 "2023-07-22T14:42:05Z")

</div>

Hi,  
I need a sample spicy script for IEC 61850 or similar protocol which will atleast detect the protocol. There are few goose implementation available like one by [J-Gras Goose analyzer](https://github.com/kit-dsn/zeek-goose-analyzer) but these are either meant for zeek 2.6 or zeek 5.0 and as discussed with @ J-Gras , it seems very difficult to port it for zeek 6.0.[Porting discussion](https://github.com/kit-dsn/zeek-goose-analyzer/issues/1) So it will helpful if anyone can throw some lights on this and provide basic spicy script to start with.

Thanks  
Biswa

---

<div class="post-metadata">

**Author:** ![Benjamin\_Bannier](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/benjamin_bannier/32/595_2.png) [@Benjamin\_Bannier](https://community.zeek.org/u/Benjamin_Bannier)\
**Post date:** [July 22, 2023, 7:47pm UTC](https://community.zeek.org/t/need-a-sample-spicy-script-to-detect-iec-61850/7095/2 "2023-07-22T19:47:04Z")

</div>

The [Zeek package template](https://docs.zeek.org/en/master/devel/spicy-analyzers.html#writing-analyzers-with-spicy) comes with a basic Spicy setup to get your own development started. Once you have that set up I would suggest you go through the Spicy documentation\[1\]\[2\] to learn how to write such an analyzer and how to integrate it with Zeek.

* * *

1. [https://docs.zeek.org/projects/spicy/en/latest/getting-started.html](https://docs.zeek.org/projects/spicy/en/latest/getting-started.html) 

2. [https://docs.zeek.org/projects/spicy/en/latest/zeek.html](https://docs.zeek.org/projects/spicy/en/latest/zeek.html)

---

<div class="post-metadata">

**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\
**Post date:** [August 3, 2023, 4:47pm UTC](https://community.zeek.org/t/need-a-sample-spicy-script-to-detect-iec-61850/7095/3 "2023-08-03T16:47:38Z")

</div>

Hi @Benjamin_Bannier , I mistakenly posted my doubt in the zeek GitHub issue list. Can you please go through the spicy script once and suggest the changes!

[Spicy issue](https://github.com/zeek/zeek/issues/3214)

Thanks  
Biswa

---

<div class="post-metadata">

**Author:** ![Benjamin\_Bannier](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/benjamin_bannier/32/595_2.png) [@Benjamin\_Bannier](https://community.zeek.org/u/Benjamin_Bannier)\
**Post date:** [August 7, 2023, 9:23am UTC](https://community.zeek.org/t/need-a-sample-spicy-script-to-detect-iec-61850/7095/4 "2023-08-07T09:23:24Z")

</div>

I answered over in the Spicy repo. As you correctly mentioned, a better place for such discussions would be here in the Discourse instance.