# Unknown protocol handling in zeek

**URL:** <https://community.zeek.org/t/unknown-protocol-handling-in-zeek/7746>\
**Category:** Zeek\
**Tags:** development\
**Created:** [April 10, 2025, 6:22pm UTC](https://community.zeek.org/t/unknown-protocol-handling-in-zeek/7746 "2025-04-10T18:22:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![biswa61](https://avatars.discourse-cdn.com/v4/letter/b/f08c70/32.png) [@biswa61](https://community.zeek.org/u/biswa61)\
**Post date:** [April 10, 2025, 6:22pm UTC](https://community.zeek.org/t/unknown-protocol-handling-in-zeek/7746/1 "2025-04-10T18:22:40Z")

</div>

Hi,  
I am trying to print unknown protocol w.r.t zeek protocol analyzer in my script. So, I searched for similar feature in zeek and saw unknown\_protocol() event is there. I am using zeek 6.1.1, that event was there. So, I tried with a simple script as below, but zeek is not producing any event for unknown protocol like hart-ip, bsap-ip, omron etc. Is there anything else I am missing while using this feature?

```auto

event unknown_protocol(analyzer_name: string, protocol: count, first_bytes: string)
        {
        local un_info : Unknown_Info;
        un_info$ts = network_time();
        un_info$analyzer = analyzer_name;
        un_info$protocol_id = fmt("0x%x", protocol);
        un_info$protocol_id_num = protocol;
        un_info$first_bytes = bytestring_to_hexstr(first_bytes);

        print "Unknown protocpl dump", un_info;
        Log::write(LOG_UNKNOWN, un_info);
        }

```

Thanks  
Biswa

---

<div class="post-metadata">

**Author:** ![biswa61](https://avatars.discourse-cdn.com/v4/letter/b/f08c70/32.png) [@biswa61](https://community.zeek.org/u/biswa61)\
**Post date:** [April 13, 2025, 6:21pm UTC](https://community.zeek.org/t/unknown-protocol-handling-in-zeek/7746/2 "2025-04-13T18:21:20Z")

</div>

@awelzel Can you please comment on this?  
The requirement is to get event for unknown protocol along with its 5 tuple \< srcip,dstip,srcport,dstport,protocol number). It should work independently along with other enabled analyzer.

---

<div class="post-metadata">

**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\
**Post date:** [April 15, 2025, 7:32am UTC](https://community.zeek.org/t/unknown-protocol-handling-in-zeek/7746/3 "2025-04-15T07:32:02Z")

</div>

Hello @biswa61 - the `unknown_protocol` event is meant for layer 2 / layer 3. If the protocols you mention are all on top of UDP or TCP (is that true for omron?) then `unknown_protocol` isn’t the event you’re looking for.

If your requirement is to flag unknown application protocols on top of TCP or UDP?

There’s `dpd/detect-protocols.zeek` which isn’t exactly what you’re looking for, but maybe a starting point?

---

<div class="post-metadata">

**Author:** ![biswa61](https://avatars.discourse-cdn.com/v4/letter/b/f08c70/32.png) [@biswa61](https://community.zeek.org/u/biswa61)\
**Post date:** [April 15, 2025, 2:51pm UTC](https://community.zeek.org/t/unknown-protocol-handling-in-zeek/7746/4 "2025-04-15T14:51:07Z")

</div>

Yes any protocol may be on layer2 or layer3 (top of tcp/udp), whichever zeek is not able to recognize using inbuilt or custom analyzer, if zeek can log or send notification. The goal is see such packets, having unknown protocol ( 5 tuple), flowing in my network.

Thanks @awelzel for the reply.

Regards  
Biswa