# Relationship between custom protocol analyzer and weird log
**URL:** https://community.zeek.org/t/relationship-between-custom-protocol-analyzer-and-weird-log/4919
**Category:** Zeek
**Created:** [June 27, 2017, 4:14pm UTC](https://community.zeek.org/t/relationship-between-custom-protocol-analyzer-and-weird-log/4919 "2017-06-27T16:14:46Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Valerio](https://community.zeek.org/u/Valerio)
#### Post date: [June 27, 2017, 4:14pm UTC](https://community.zeek.org/t/relationship-between-custom-protocol-analyzer-and-weird-log/4919/1 "2017-06-27T16:14:46Z")
Hi all,
I am experiencing a strange behaviour in BRO that I am not able to
troubleshoot autonomously.
I developed a simple binary protocol analyzer that produces a log file
of type prot1.log.
If I run bro offline on a dedicated pcap it correctly outputs prot1.log
with the proper record.
If I run bro sniffing on an interface and I tcpreplay the pcap on the
sniffed interface I get weird.log with SYN\_inside\_connection warning.
Is weird preemting the application of my analyzer?
many thanks in advance,
Valerio
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/relationship-between-custom-protocol-analyzer-and-weird-log/4919/2 "2022-05-06T15:45:05Z")