# Packet Analyzer over TCP

**URL:** <https://community.zeek.org/t/packet-analyzer-over-tcp/7655>\
**Category:** Development\
**Created:** [December 5, 2024, 6:36am UTC](https://community.zeek.org/t/packet-analyzer-over-tcp/7655 "2024-12-05T06:36:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zeek\_Noob](https://avatars.discourse-cdn.com/v4/letter/z/aeb1de/32.png) [@Zeek\_Noob](https://community.zeek.org/u/Zeek_Noob)\
**Post date:** [December 5, 2024, 6:36am UTC](https://community.zeek.org/t/packet-analyzer-over-tcp/7655/1 "2024-12-05T06:36:51Z")

</div>

Hello Zeek Community,

I’m trying to develop my first plugin using spicy and now I have trouble getting it up and running with zeek.  
The protocol is pretty simple. Two hosts are sharing information over an ongoing tcp connection. I realized (when using a protocol analyzer) zeek sticks to the first packet in the connection. So I tried to switch to a packet analyzer.  
Using the following function call `PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_TCP, <identifier?>, PacketAnalyzer::ANALYZER_SPICY_MYANALYZER)` it seems to register. But no event is triggered.

So my questions are:

1. Is their a solution with a ProtocolAnalyzer?
2. How to make the PacketAnalyzer work on top of tcp?
3. What would the identifier in register\_packet\_analyzer be when using tcp (since tcp does not have a corresponding field)

Thanks in advance. Hope you all have a wonderful day.

Your zeek noob

---

<div class="post-metadata">

**Author:** ![Benjamin\_Bannier](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/benjamin_bannier/32/595_2.png) [@Benjamin\_Bannier](https://community.zeek.org/u/Benjamin_Bannier)\
**Post date:** [December 5, 2024, 1:03pm UTC](https://community.zeek.org/t/packet-analyzer-over-tcp/7655/2 "2024-12-05T13:03:17Z")

</div>

> [@Zeek\_Noob](#):
>
> I realized (when using a protocol analyzer) zeek sticks to the first packet in the connection.

Could you explain more what you are seeing and what you would have expected? Could it be that you are running into [FAQ — Book of Zeek (git/master)](https://docs.zeek.org/en/master/devel/spicy/faq.html#faq-zeek-tcp-analyzer-not-all-messages-recognized)?

> [@Zeek\_Noob](#):
>
> So I tried to switch to a packet analyzer.

[Packet analyzers](https://docs.zeek.org/en/master/frameworks/packet-analysis.html#) have a different role, and if you want to analyze a protocol on top of TCP you probably do want a protocol analyzer.

---

<div class="post-metadata">

**Author:** ![Zeek\_Noob](https://avatars.discourse-cdn.com/v4/letter/z/aeb1de/32.png) [@Zeek\_Noob](https://community.zeek.org/u/Zeek_Noob)\
**Post date:** [December 11, 2024, 12:16pm UTC](https://community.zeek.org/t/packet-analyzer-over-tcp/7655/3 "2024-12-11T12:16:41Z")

</div>

Hello @Benjamin_Bannier,

thank you for the fast response.

It happened to be a mixture of problems on my site. One part had been solved with the Book of Zeek and the other part was a miscalculation. Once I fixed that everything worked just fine.

Thanks again.