Using Spicy to develop the analyzer in "middle layers"?

Zeek
1

Hi,

Transitioning from the previous experience of developing analyzer in Binpac, I find that Spicy provides some additional flexibility, independence, and portability, making zeek-side of the codes cleaner. I have already tried to develop an application layer analyzer for a custom protocol based on TCP that I used for the class that I am teaching right now.

From Spicy documentation, I see that we can also use Spicy to develop analyzers on top of “RawLayer” as well as over TCP/UDP. My question is that is it possible to use Spicy to develop analyzers for protocols in middle layers? For example, for protocol running directly on top of Ethernet or protocols running directly on top of IP layer?

Thank you and best regards,

Hui Lin

2

Hi Hui,

Two answers:

*My question is that is it possible to use Spicy to develop
analyzers for protocols in middle layers? For example, for protocol
running directly on top of Ethernet

Yes, assuming you’re using Zeek 4.0, you can add a new “packet analyzer” through Spicy. See the docs a little bit down in this section: https://docs.zeek.org/projects/spicy/en/latest/zeek.html#analyzer-setup

There’s also an example coming with the Spicy plugin’s tests: https://github.com/zeek/spicy-plugin/blob/main/tests/zeek/packet-analyzer.zeek

or protocols running directly on top of IP layer?*

Not yet. It’s a limitation of Zeek’s plugin API (not Spicy) that doesn’t support this yet. However, we’re working on adding that support, should happen at some point during the 4.x cycle.

Robin

3

Hi Robin,

Thank you so much for your answer. I am looking forward to the update.

Even though Zeek supported DNP3 and Modbus, these two protocols are ancient. The more updated protocols for industrial control systems, such as Industrial Ethernet Protocols, will provide protocols in all different layers in TCP/IP stacks. Some colleagues and I have students at the University of Rhode Island to do such development on Spicy once these features become available. I believe this can really make Zeek attractive to those utility providers.

Best regards,

Hui Lin