Need help for wirte pulgin

Zeek
1

hi, zeeker:

I am try to write a PacketAnalyzer plugin use init-plugin, it does the same work as the vxlan built-in plugin, but my zeek script(PacketAnalyzer::register_for_ports(PacketAnalyzer::ANALYZER_UDP, PacketAnalyzer::ANALYZER_MYTEST, vxlan_ports)) runs with an error:

error in ./main.zeek, ​​line 19: unknown identifier PacketAnalyzer::ANALYZER_MYTEST, at or near “PacketAnalyzer::ANALYZER_MYTEST”

I don’t know where and how to define my PacketAnalyzer::ANALYZER_MYTEST. and i cannot find where the built-in PacketAnalyzer::ANALYZER_VXLAN define.

Thank you for your help!

2

Hey @liuchuang - any chance you could upload your code to GitHub for inspection?

If not, please be more detailed in how you compile/run Zeek.

Thanks,
Arne

3

Thank you for your reply, after multiple failures, I have tried to successfully complete it, now my code runs ok. but I still don’t understand where my PacketAnalyzer::ANALYZER_MYTEST is defined in the zeek script.

There are too few explanations about c++ plugins on docs.zeek.org, and there is a lack of fundamental explanations.