# some information

**URL:** <https://community.zeek.org/t/some-information/3076>\
**Category:** Zeek\
**Created:** [April 22, 2014, 3:20pm UTC](https://community.zeek.org/t/some-information/3076 "2014-04-22T15:20:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prateek\_Gupta](https://avatars.discourse-cdn.com/v4/letter/p/f17d59/32.png) [@Prateek\_Gupta](https://community.zeek.org/u/Prateek_Gupta)\
**Post date:** [April 22, 2014, 3:20pm UTC](https://community.zeek.org/t/some-information/3076/1 "2014-04-22T15:20:40Z")

</div>

Hello everyone,

I want to know that which module in the source code supplies the information to the root node of the analyzer tree (i.e. Tansport Layer Analyzer) . Where should I look for in the source code.  
Urgently need to understand the information flow and the data structures involved to the analyzer layer for an academic project.

Also I have been able to use sample analyzer provided in the bro site but how to test run it easily. Can I do something like modifying it like some already made protocol (ex. dhcp etc) and test run it or what?

Hoping for a reply.

Regards,

Prateek

---

<div class="post-metadata">

**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\
**Post date:** [April 22, 2014, 6:10pm UTC](https://community.zeek.org/t/some-information/3076/2 "2014-04-22T18:10:22Z")

</div>

> I want to know that which module in the source code supplies the information to the root node of the analyzer tree (i.e. Tansport Layer Analyzer) . Where should I look for in the source code.  
> Urgently need to understand the information flow and the data structures involved to the analyzer layer for an academic project.

See Connection::NextPacket which is called from NetSessions::DoNextPacket.

> Also I have been able to use sample analyzer provided in the bro site but how to test run it easily. Can I do something like modifying it like some already made protocol (ex. dhcp etc) and test run it or what?

You can do whatever you need/like in the implementation of the sample analyzer (e.g. the overrides of Analyzer::DeliverStream or Analyzer::DeliverPacket).

Then, to get the sample analyzer attached to particular connections so it will actually process data, there’s a choice of

(1) look in to how the Analyzer::register\_for\_ports script-layer function is used for other protocol analyzers  
(2) look in to how other analyzers use DPD signatures to automatically attach themselves to a connection when the payload matches a signature  
(3) hardcode the sample analyzer to be used for every connection.

It’s typical to combine (1) and (2).

- Jon

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/some-information/3076/3 "2022-05-06T15:41:43Z")

</div>