# Zeek 7.1 - zeek.dpd (/src/zeek/src/analyzer/protocol/ldap/ans1.spicy:\) Data is missing **URL:** \ **Category:** Zeek\ **Created:** [March 18, 2025, 1:28pm UTC](https://community.zeek.org/t/zeek-7-1-zeek-dpd-src-zeek-src-analyzer-protocol-ldap-ans1-spicy-value-data-is-missing/7730 "2025-03-18T13:28:21Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![w2k8](https://avatars.discourse-cdn.com/v4/letter/w/2acd7d/32.png) [@w2k8](https://community.zeek.org/u/w2k8)\ **Post date:** [March 18, 2025, 1:28pm UTC](https://community.zeek.org/t/zeek-7-1-zeek-dpd-src-zeek-src-analyzer-protocol-ldap-ans1-spicy-value-data-is-missing/7730/1 "2025-03-18T13:28:21Z")
Hi, I am testing zeek 7.1 when i compare the output of zeek 6.2 and zeek 7.1 i see parsing errors in dpd.log The error in dpd.log is: ./dpd.log:{“ts”:“2025-03-17T00:00:00.000000Z”,…,“id.resp\_p”:389,“proto”:“tcp”,“analyzer”:“LDAP\_TCP”,“failure\_reason”:“data is missing (/src/zeek/src/analyzer/protocol/ldap/asn1.spicy:115:10-115:14)”} Also, i see the same message in analyzer.log ./analyzer.log:{“ts”:“2025-03-17T00:00:00.000000Z”,“cause”:“violation”,“analyzer\_kind”:“protocol”,“analyzer\_name”:“LDAP\_TCP”,…,“id.resp\_p”:389,“failure\_reason”:“data is missing (/src/zeek/src/analyzer/protocol/ldap/asn1.spicy:115:10-115:14)”} I am using the docker container zeek/zeek:7.1 ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [March 18, 2025, 2:34pm UTC](https://community.zeek.org/t/zeek-7-1-zeek-dpd-src-zeek-src-analyzer-protocol-ldap-ans1-spicy-value-data-is-missing/7730/2 "2025-03-18T14:34:00Z")
Does the error occur in Zeek 7, or in 6.2? If in 7.1 - do you have a pcap that can reproduce the error? Without that we won’t be able to help or look what is going on. ---
**Author:** ![w2k8](https://avatars.discourse-cdn.com/v4/letter/w/2acd7d/32.png) [@w2k8](https://community.zeek.org/u/w2k8)\ **Post date:** [March 19, 2025, 5:51am UTC](https://community.zeek.org/t/zeek-7-1-zeek-dpd-src-zeek-src-analyzer-protocol-ldap-ans1-spicy-value-data-is-missing/7730/3 "2025-03-19T05:51:54Z")
Hi Johanna, I am using Zeek 7 in a docker container zeek/zeek:7.1 I am not allowed to provide a pcap. ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [March 19, 2025, 7:57am UTC](https://community.zeek.org/t/zeek-7-1-zeek-dpd-src-zeek-src-analyzer-protocol-ldap-ans1-spicy-value-data-is-missing/7730/4 "2025-03-19T07:57:51Z")
In that case, we can only be of limited help to you. To figure out what is going on, you will have to isolate the specific connection that is being sent. Then you will have to look at the bytes that the error is being raised for, to see if this is a connection error or an error in the parser. In this case, it looks like Zeek is expecting to parse some more ASN1 data, where the data is missing from the connection. ---
**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\ **Post date:** [March 19, 2025, 8:30am UTC](https://community.zeek.org/t/zeek-7-1-zeek-dpd-src-zeek-src-analyzer-protocol-ldap-ans1-spicy-value-data-is-missing/7730/5 "2025-03-19T08:30:28Z")
> :“data is missing (/src/zeek/src/analyzer/protocol/ldap/asn1.spicy:115:10-115:14)”} Hey @w2k8 - long shot, but could you check whether the TCP stream has gaps first? You can do by looking at conn.log’s history field for `g` for `G` and checking the `missed_bytes` column from conn.log might give an indication. There’s also the following recent ticket - could you check if it’s the same for you? > > > When running an LDAP search query for Active Directory domain users, \`ldap\_searc…h.log\` file is missing if the initial authentication is over Kerberos. Also, the \`failure\_reason\` in \`analyzer.log\` shows > \`\`\` > &size amount not consumed: expected 813813248 bytes, but got 203 bytes (/home/mohan/Software/Opensource/zeek/src/analyzer/protocol/ldap/ldap.spicy:288:5-288:26) > \`\`\` > > However, if the initial authentication was over NTLM, the \`ldap\_search.log\` file is present. The attached pcaps highlight the issue. > > \[aduser1.pcap.txt\](https://github.com/user-attachments/files/19164901/aduser1.pcap.txt) > \[aduser1-ntlm.pcap.txt\](https://github.com/user-attachments/files/19164902/aduser1-ntlm.pcap.txt) ---
**Author:** ![w2k8](https://avatars.discourse-cdn.com/v4/letter/w/2acd7d/32.png) [@w2k8](https://community.zeek.org/u/w2k8)\ **Post date:** [March 19, 2025, 11:44am UTC](https://community.zeek.org/t/zeek-7-1-zeek-dpd-src-zeek-src-analyzer-protocol-ldap-ans1-spicy-value-data-is-missing/7730/6 "2025-03-19T11:44:13Z")
Hi Awelzel. That specific pcap give me an other parsings error: `{"ts":"2025-03-10T08:54:48.525312Z","uid":"CJ7c1bGkGLYveYMJh","id.orig_h":"192.168.226.131","id.orig_p":54544,"id.resp_h":"192.168.226.136","id.resp_p":389,"proto":"tcp","analyzer":"LDAP_TCP","failure_reason":"&size amount not consumed: expected 813813248 bytes, but got 203 bytes (/src/zeek/src/analyzer/protocol/ldap/ldap.spicy:288:5-288:26)"}` the code in asn1.spicy, line 115:10 /usr/local/zeek/share/spicy/ldap/asn1.spicy ```auto 111. #- ASN.1 octet string --------------------------------------------------------- 113. # https://www.obj-sys.com/asn1tutorial/node10.html 113 114. type ASN1OctetString = unit(len: uint64, constructed: bool) { 115. value: bytes &size = len; 116 117. # TODO - constructed form 118. }; ``` ---
**Author:** ![w2k8](https://avatars.discourse-cdn.com/v4/letter/w/2acd7d/32.png) [@w2k8](https://community.zeek.org/u/w2k8)\ **Post date:** [March 19, 2025, 1:42pm UTC](https://community.zeek.org/t/zeek-7-1-zeek-dpd-src-zeek-src-analyzer-protocol-ldap-ans1-spicy-value-data-is-missing/7730/7 "2025-03-19T13:42:20Z")
Looks like missing bytes. thanks