# VRRP/CARP Packet Analyser **URL:** \ **Category:** Zeek\ **Created:** [April 13, 2019, 7:14am UTC](https://community.zeek.org/t/vrrp-carp-packet-analyser/5663 "2019-04-13T07:14:36Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Andrew\_Klaus](https://avatars.discourse-cdn.com/v4/letter/a/779978/32.png) [@Andrew\_Klaus](https://community.zeek.org/u/Andrew_Klaus)\ **Post date:** [April 13, 2019, 7:14am UTC](https://community.zeek.org/t/vrrp-carp-packet-analyser/5663/1 "2019-04-13T07:14:36Z")
Hello, In my weird.log, I’ve noticed unknown\_protocol\_112 showing up regularly for me. I believe this to be the Virtual Router Redundancy Protocol (VRRP), which does match up with CARP that’s enabled on our OpenBSD firewalls. Before I start looking further, has anyone built a parser for Zeek already? If not, I’ll start reading the protocol spec and seeing if I’m able to write one. I believe it to be useful to have the protocol analyzed for noticing any anomalies, etc. Thanks! Andrew ---
**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\ **Post date:** [April 18, 2019, 2:30am UTC](https://community.zeek.org/t/vrrp-carp-packet-analyser/5663/2 "2019-04-18T02:30:46Z")
I haven't heard of anyone working on this fwiw. Feel free to reach out again if you need help with anything!    .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/vrrp-carp-packet-analyser/5663/3 "2022-05-06T15:46:26Z")